Add artifacts to case(s) or case task(s)

After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.

Before you begin

Role required: admin

Note:

Artifacts are available only to the existing cases. For observables and indicators, the artifacts can also be added or associated to a case from the import job using the Import Intelligence button. For more information on how to import see, Import Intelligence in TISC

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Click Threat Analyst Workbench icon.
3. Go to Case Management > All Cases.
   All the cases are displayed.
4. Select any case or case task.
5. Go to Artifacts tab.
   The associated artifacts are displayed as the related lists for that specific case or case task.
6. Link or Unlink the records from the case or case task.
   Note:

   For more information, see Link Threat Intel Related Records

   Following table lists the artifacts related lists related to the case(s) or case task(s):

   Table 1. Related Records

   Related List	Description
   MITRE Techniques	List the MITRE techniques related to the case(s). MITRE techniques also displays all the associated techniques in a case.
   Observable	List of observables related to this cases or case tasks.
   Indicators	List of indicators related to this cases or case tasks.
   Attack Patterns	List of attack patterns that are related to this cases or case tasks.
   Campaigns	List the campaigns that are related to this cases or case tasks.
   Course of Actions	List the course of actions that are related to this cases or case tasks.
   Data Components	List of Data Components that are related to this cases or case tasks.
   Threat Groupings	List the threat groupings that are related to this cases or case tasks.
   Identities	List the identities that are related to this cases or case tasks.
   Infrastructure	List the Infrastructure such as systems, software services, and any associated physical or virtual resources that are related to this cases or case tasks.
   Intrusion Sets	List the intrusion sets such as a set of adversarial behaviors and resources with common properties that are related to this cases or case tasks.
   Locations	List the locations records that are related to this cases or case tasks.
   Malware	List the malware source records that are related to this cases or case tasks.
   Marking Definitions	List the marking definitions records that are related to this cases or case tasks.
   Threat Notes	List the marking definitions records that are related to this cases or case tasks.
   Observed Data	List the observed data that are related to this cases or case tasks.
   Threat Opinions	List the threat opinions that are related to this cases or case tasks.
   Threat Reports	List the threat reports that are related to this cases or case tasks.
   Sightings	List of sightings that are related to this cases or case tasks.
   Threat Actors	List the threat actors that are related to this cases or case tasks.
   Tools	List the tools that are related to this cases or case tasks.
   Vulnerabilities	If the observable is an IP address, this list shows any resources (configuration items) that have a matching IP address that are related to this cases or case tasks.
   Related Cases	Lists the related cases.
   Related Case Tasks	Lists the related case tasks.
   Security Incidents	List the security incidents that are related to this cases or case tasks.
   Affected Configuration Items	List the affected configurations items that are related to this cases or case tasks.
   Affected Services	List the affected services that are related to this cases or case tasks.
   Affected Assets	List the affected assets that are related to this cases or case tasks.
   Vulnerability Entries	List the vulnerability entries that are related to this cases or case tasks.

• Roll up of MITRE Techniques from Artifacts to Case
  When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.
• Show MITRE ATT&CK Framework for a Case(s)
  Displays all the associated techniques of a case on the MITRE ATT&CK framework.

Related concepts

• Workbench Overview
• Working with Investigation Canvas
• Using playbooks

Related tasks

• Creating cases using Threat Analyst Workbench
• Creating case task using Threat Analyst Workbench
• Run Enrichment Actions within a case
• View Case Reports
• Create a security incident from a TISC case
• Upload Secure File Attachments