Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows the user to save a citation for quick and efficient future use.
Viewing and Editing the Source Attribute
- From the top navigation bar (Figure 1), place the cursor over Browse and then over the Indicators or Groups option. Click on one of the objects (Host Indicator in this example) to display a results table (Figure 2).
- Click on an entry, and the Details drawer for that entry will will be displayed (Figure 3).
- Click the Details icon at the top right corner of the drawer, and the Overview tab of the Details screen will be displayed (Figure 4). Alternatively, hover over the object's entry in the table in Figure 2 and click on the Details icon that appears on the right side of its Summary cell to go straight to the Overview tab of the Details screen.
- Scroll down to the Attributes card (Figure 5).
- Click the Plus button. The Edit Attribute window will be displayed (Figure 6).
- Select a Type: Select Source from this dropdown menu. A checkbox labeled Default will appear below the menu. Objects are permitted to have multiple Source Attributes. If desired, select this checkbox to make this Attribute the default Source Attribute.
- Choose Security Labels: Choose one or more Security Labels from this menu.
- Attribute Source: Select a pre-existing source from the dropdown menu, or click inside the box and enter a name for a new Source.
- Save Source: Select this checkbox to save the Source so that it may be used again by the owner.
- Text Box: It is good practice to enter the Source’s URL in the text box at the bottom of the window. If there is no such URL (such as when an Indicator is obtained from a listserv), then this box may be left blank.
- Click the SAVE button.