ThreatConnect® allows users to set an Indicator’s Threat Rating and its associated Confidence Rating. The Threat Rating identifies how much of a threat an Indicator represents and is measured on a scale of 0–5 skulls—the higher the rating, the higher the threat. The Confidence Rating is an expression of how confident an owner is that its Threat Rating assessment is accurate, and it is measured on a scale of 0–100. These two rankings are important because they allow users to focus on Indicators that represent the most active and relevant threats to their networks. See Evilness Rating: Skulls Scale for Cyber Threats for guidelines on assigning Threat Ratings and Confidence Ratings.
Setting Threat and Confidence Rating
- From the top navigation bar (Figure 1), place the cursor over Browse and then over the Indicators option. Click on one of the objects (Host Indicator in this example) to display a results table (Figure 2).
- Click on one of the entries. The Details drawer for that entry will be displayed (Figure 3).
- Click the Details icon at the top right corner of the drawer. The Overview tab of the Details screen will be displayed (Figure 4). Alternatively, hover over the object's entry in the table in Figure 2 and click on the Details icon that appears on the right side of its Summary cell to go straight to the Overview tab of the Details screen.
- Scroll down to the Details card (Figure 5). Click on the appropriate skull to set the Threat Rating. Drag the slider to set the Confidence Rating. The changes are automatically saved.