The Details Drawer

When viewing Indicators, Groups, Tags, Tracks, Victims, or Victim Assets on the Browse screen, you can click on an object to display its Details drawer and view a detailed overview of the object. For example, Figure 1 shows the Details drawer for the badguy.com Host Indicator.

Details Drawer Sections

The Details drawer displays several sections with relevant information for the object you are viewing. Depending on the object’s type, the sections and elements displayed on this drawer will vary.

Indicators

Table 1 provides a description of each section that may be displayed on the Details drawer for an Indicator and the Indicator type(s) for which each section is available.

Groups

Table 2 provides a description of each section that may be displayed on the Details drawer for a Group and the Group type(s) for which each section is available.

Tags

Table 3 provides a description of each section that may be displayed on the Details drawer for a Tag.

Name	Description
Associated Indicators	The Indicator(s) to which the Tag is applied. If there are more than 10 Indicators, a link labeled all associated indicators... will be displayed at the bottom of this section. Click it to display the Tag’s legacy Details screen and view all Indicators to which it is applied on the Associations card .
Associated Intel	The Group(s) to which the Tag is applied.
Associated Victims	The Victim(s) to which the Tag is applied.
Explore in Graph	Click the Explore in Graph button to view the Tag in Threat Graph.
Last Used	The date when the Tag was last used. For Tags that have not been used since the Last Used date was introduced in ThreatConnect, this section will display a value of Unknown.
Owner	The Organization, Community, or Source to which the Tag belongs.
Summary	The Tag’s summary.
Synonymous Tags	This section is displayed only for main Tags defined in Tag normalization rules (i.e., Tags with anicon displayed to the left of their name in the Summary column on the Browse screen) and provides a list of synonymous Tags associated with the main Tag.
Type	This section will always display a value of “Tag.”

Tracks

Table 4 provides a description of each section that may be displayed on the Details drawer for a Track.

Victims

Table 5 provides a description of each section that may be displayed on the Details drawer for a Victim.

Victim Assets

Table 6 provides a description of each section that may be displayed on the Details drawer for a Victim Asset.

Pivoting From the Details Drawer

If viewing the Details drawer for an Indicator, Group, or Tag, click the vertical ellipsis at the upper-right corner of the drawer and select Pivot to pivot from the object and view its associated objects on the Browse screen.

Accessing the Details Screen From the Details Drawer

To view the Overview tab of the object’s Details screen, click View full detailsat the upper-right corner of the Details drawer. Alternatively, hover over the object’s entry in the table on the Browse screen and click one of the following icons displayed in its Summary cell (Figure 2):

• View full details: Click this icon to open the object’s Details screen in the current browser tab.
• View details in new tab: Click this icon to open the object’s Details screen in a new browser tab.

Note

For a Victim Asset, no icons are displayed when you hover over its entry in the table on the Browse screen. Instead, you must click on its entry in the table to display its Details drawer and then click the View full detailsicon at the upper-right corner of the drawer, which will display the Details screen for the Victim to which the Victim Asset belongs.

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20051-03 v.16.B