Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows the user to save a citation for quick and efficient future use.
- From the top navigation bar (Figure 1), place the cursor over BROWSE and then over the INDICATORS or GROUPS option. Click on one of the objects (HOST Indicator in this example) to display a results table (Figure 2).
- Click on an entry, and the Details flyout for that entry will appear (Figure 3).
- Click the Details icon at the top right corner of the flyout, and the Overview tab of the Details screen will appear (Figure 4). Alternatively, hover over the object's entry in the table in Figure 2 and click on the Details icon that appears on the right side of its Summary cell to go straight to the Overview tab of the Details screen.
- Scroll down to the Attributes card (Figure 5), and click the Plus (+) button. The Edit Attribute window will appear (Figure 6).
- Click on the Select a Type dropdown menu and select Source. Click the Default checkbox that appears if this Attribute is to be the default source Attribute.
- Click on the Choose Security Labels dropdown menu and choose a label.
- Use the Attribute Source dropdown menu to select a pre-existing source, or click inside the box and enter a name for a new source.
- Check the Save Source checkbox to save the source so that it may be used again by the owner.
- In the text box at the bottom of the window, consider including the source’s URL. If there is no URL (such as when an Indicator is obtained from a listserv), then leave this box blank.
- Click the SAVE button. The data entered for the Attribute will now appear in the Attributes card (Figure 7).