Associations Card for Cases
  • 17 May 2024
  • 5 Minutes to read
  • Dark
    Light

Associations Card for Cases

  • Dark
    Light

Article summary

Figure 1 shows an example of the Associations card for a Case, which is located below the Attributes card on the right side of the screen displaying the Case. You can collapse and expand the Associations card by hovering the cursor anywhere in the card and clicking the arrow displayed at the upper-right corner of the card.

Graphical user interface, application  Description automatically generated

 

Indicators

Expand the Indicators section to display all Indicators manually associated to the Case you are viewing (Figure 2). Each Indicator’s type, CAL score, Indicator Status, ThreatAssess score, and creation date will be displayed in the table.

Graphical user interface, application, Teams  Description automatically generated

 

To view the owner(s) to which an Indicator belongs, click the arrowIcon  Description automatically generatedicon to the right of its summary.

Viewing Indicator Details

Select an owner in the arrowIcon  Description automatically generateddropdown to display the Details drawer for the Indicator in that owner. You can also click the link in the Summary column or select Details from the vertical ellipsis to the right of an Indicator’s table entry to display the Details drawer for the Indicator in the owner listed at the top of the arrowIcon  Description automatically generateddropdown.

Adding Indicator Associations

To add a new associated Indicator to the Case, click the New… Diagram  Description automatically generatedbutton at the upper-right corner of the Case and select Associate Indicator, or click Add IndicatorsIcon  Description automatically generatedat the top right of the Indicators section. The Add Related Intelligence drawer will be displayed, showing all available Indicators that are not associated to the Case (Figure 3).

Graphical user interface  Description automatically generated

 

  • Select one or more Indicators to associate to the Case. If desired, use the FILTERS selector to filter Indicators by type, owner, a range of dates within which Indicators were last modified, or a range of dates within which Indicators were created. You can also enter text in the box to the right of the FILTERS selector to filter Indicators by summary. To view the Details drawer for an Indicator, click its summary in the Summary column.
  • Click the ADD SELECTED button. The selected Indicator(s) will be associated to the Case and added to the Indicators table on the Associations card.
    Note
    All copies of a selected Indicator in all owners to which you have access will be added as associations, even if you select a copy in only one owner. For example, if a bad.com Host Indicator exists in your Organization, a Community, and a Source and you select only the copy in the Community, all three copies of bad.com will be added as associations.

Removing Indicator Associations

To dissociate an Indicator from a Case, select Dissociate from the vertical ellipsis to the right of an Indicator’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.

Note
When you dissociate an Indicator from a Case, all copies of the Indicator in all owners will be dissociated.

Groups

Expand the Groups section to display all Groups, categorized by type, manually associated to the Case you are viewing (Figure 4). When a Group type’s section is expanded, the summary and creation date for each Group of that type will be displayed..

Graphical user interface, application  Description automatically generated

 

Note
Campaigns and Threats are displayed at the top of the section with an orange bar to the left and are expanded by default in order to prioritize them.

To view the owner(s) to which a Group belongs, click the arrowIcon  Description automatically generatedicon to the right of its summary.

Viewing Group Details

Select an owner in the arrow Icon  Description automatically generateddropdown to display the Details drawer for the Group in that owner. You can also click the link in the Summary column or select Details from the vertical ellipsis to the right of a Group’s table entry to display the Details drawer for the Group in the owner listed at the top of the arrowIcon  Description automatically generateddropdown.

Adding Group Associations

To add a new associated Group to the Case, click the New… Diagram  Description automatically generatedbutton at the upper-right corner of the Case and select Associate Group, or click Add GroupsIcon  Description automatically generatedat the top right of the Groups section. The Add Related Intelligence drawer will be displayed, showing all available Groups (Figure 5).

Graphical user interface, table  Description automatically generated

 

  • Select one or more Groups to associate to the Case. If desired, use the FILTERS selector to filter Groups by type owner, a range of dates within which Groups were last modified, or a range of dates within which Groups were created. You can also enter text in the box to the right of the FILTERS selector to filter Groups by summary. To view the Details drawer for a Group, click its summary in the Summary column.
  • Click the ADD SELECTED button. The selected Group(s) will be associated to the Case and added to the Groups table on the Associations card.
    Note
    All copies of a selected Group in all owners to which you have access will be added as associations, even if you select a copy in only one owner. For example, if a Bad Guy Adversary Group exists in your Organization, a Community, and a Source and you select only the copy in the Community, all three copies of Bad Guy will be added as associations.

Removing Group Associations

To dissociate a Group from a Case, select Dissociate from the vertical ellipsis to the right of a Group’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.

Note
When you dissociate a Group from a Case, all copies of the Group in all owners will be dissociated.

Cases

Expand the Cases section to display all Cases manually associated to the Case you are viewing (Figure 6).

Table  Description automatically generated

 

Viewing Case Details

Click the Case’s name, or select Details from the vertical ellipsis to the right of the Case’s table entry, to open the Case in a new browser tab.

Adding Case Associations

To add a new associated Case, click the New… Diagram  Description automatically generatedbutton at the upper-right corner of the Case and select Associate Case, or click Add CasesIcon  Description automatically generatedat the top right of the Cases section. The Add Related Cases drawer will be displayed, showing all available Cases (Figure 7).

Graphical user interface, application  Description automatically generated

 

  • Select one or more Cases to associate to the Case you are viewing. If desired, use the FILTERS selector, the default display menu, or the box to the right of the FILTERS selector to filter the displayed Cases. For more information on how to filter Cases using these options, see the “Filtering Cases” section of Viewing, Managing, and Filtering Cases.
  • Click the ADD SELECTED button. The selected Case(s) will be associated to the Case and added to the Cases table on the Associations card for the Case.

Removing Case Associations

To dissociate a Case from the Case you are viewing, select Dissociate from the vertical ellipsis to the right of a Case’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20124-02 v.05.A


Was this article helpful?