Case Attributes

Overview

Case Attributes are key/value data sets that you can add to a Workflow Case. These Attributes enrich a Case’s data and aid security teams as they investigate a threat and determine the appropriate escalation path for a Case.

The Attributes card of a Workflow Case displays all System-level and Organization-level Attributes added to the Case. This article describes how to add Attributes to a Case, edit existing Attributes added to a Case, and remove Attributes from a Case.

Before You Start

Attributes Card

Figure 1 shows an example of the Attributes card for a Case, which is located below the Case Details card on the right side of the screen displaying the Case.

If no Attributes have been added to a Case, the text No attributes in this case. Click to add an attribute. will be displayed (Figure 2).

Adding Attributes to a Case

If no Attributes have been added to a Case, click the No attributes in this case. Click to add an attribute. text (Figure 2). The Add Attribute drawer will be displayed (Figure 3).

If at least one Attribute has been added to a Case, click the New…  button at the upper-right corner of the Case and select Attribute, or hover the cursor over the Attributes card and click the plus icon at the upper-right corner of the card. The Add Attribute drawer will be displayed (Figure 3).

• Type: Select an Attribute Type. By default, there are no pre-configured Attributes for Cases. This means that this dropdown menu will be empty unless Attribute Types for Cases are created in the System or Organization in which the Case resides.
• Create a new attribute type: Click this link to create an Attribute Type for a Case. The Org Config screen for the Organization in which the Case resides will open in a new browser tab. See Creating Custom Attribute Types  for more information about creating custom Attribute Types at the Organization level.
  Note

  Only users with a System role of Administrator can create Attribute Types at the System level. Similarly, only users with a System role of Operations Administrator or an Organization role of Organization Administrator can create Attribute Types at the Organization level.
  Note

  If you create a custom Attribute Type via the Create a new attribute type link, you must refresh the screen displaying the Case after creating the Attribute Type for it to be listed in the Type dropdown menu.

After an Attribute Type is selected from the Type dropdown in Figure 3, fields to enter the Attribute’s Value and Source will be displayed in the Add Attribute drawer (Figure 4).

• Value: Enter the Attribute’s value. Note that the type of field displayed (e.g., text box, dropdown menu, spinner) depends on the Validation Rule selected during the creation of the custom Attribute Type.
• Source: Enter the Attribute’s source.
• Click the SAVE button. The Attribute will be added to the Case and displayed in the Attributes card.

If the Allow Markdown checkbox was selected when creating a custom Attribute Type for a Case, a Preview Markdown  link will be displayed above the Value text box (Figure 5). This link indicates that the Value text box supports Markdown.

If you try to add an Attribute to a Case when the Attribute Type’s Max Allowed limit has been reached, an error message will be displayed stating that the maximum number of times that the Attribute Type (Phishing Open Rate in this example) can be added to the current Case has been exceeded (Figure 6).

Select a different Attribute Type, or remove an existing Attribute of the maxed-out Attribute Type from the Case. For instructions on how to remove an existing Attribute from a Case, see the “Removing Attributes from a Case” section.

Editing Attributes

To edit an Attribute added to a Case, click the vertical ellipsis displayed to the right of the Attribute in the Attributes card (Figure 1) and select Edit. The Edit Attribute drawer will be displayed (Figure 7).

• Make any desired changes to the Attribute’s Value or Source.
• Click the SAVE button.

Alternatively, hover the cursor over the Attribute’s Value or Source in the Attributes card (Figure 1) to display a pencil icon to the right of the label. Click this icon to edit the Attribute’s Value or Source, respectively. After making the desired changes, click the checkmark icon to save the changes (Figure 8).

Removing Attributes from a Case

To remove an Attribute from a Case, click the vertical ellipsis displayed to the right of the Attribute in the Attributes card (Figure 1) and select Remove. The Confirm Remove Attribute window will be displayed. Click the CONFIRM button to remove the selected Attribute from the Case.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20125-01 v.01.D