Private Indicators

Last Updated: Nov 15, 2018 04:58PM EST
User
Private Indicators enabled by a System Administrator

Overview

The ThreatConnect® Collective Analytics Layer (CAL) provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect. (See ThreatAssess and CAL for more information.) Customers using an On Premise or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private. A System Administrator must have enabled private Indicators in order for this feature to be present in the user interface. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private.

Marking an Indicator as Private

Indicators may be marked as private in five locations within ThreatConnect.

The Details Screen

Follow these steps to mark an Indicator as private within the Indicator Analytics card on its Details screen:

  1. Navigate to the Overview tab of the Details screen. If private Indicators have been enabled, then there will be a checkbox labeled Private at the top right of the CAL section of the Indicator Analytics card (Figure 1).
  2. Click the Private checkbox to designate the Indicator as private. The Indicator Analytics card will now display no CAL data, and data on the Indicator will not be sent to CAL for aggregation (Figure 2). The CAL portion of the Details window for the Indicator will also display a message to that effect. To disable privacy for the Indicator, uncheck the box.

The Create Indicator Window

To mark an Indicator as private when creating the Indicator using the Create Indicator window (see Create), click the Private checkbox at the bottom of the screen (Figure 3), which will be present only if private Indicators have been enabled.

The Create Group Wizard

To mark an Indicator as private when using the Create Group wizard to associate Indicators to a new Group (see Create), click the checkbox in the Indicator’s Private column in the Associations table in the Associations step of the wizard (Figure 4). This column will be present only if private Indicators have been enabled.

Indicator Import

To mark an Indicator as private when doing a structured import (see Structured Indicator Import), click the checkbox in the Indicator’s Private column on the Confirm tab of the Import Indicators - Structured screen (Figure 5). This column will be present only if private Indicators have been enabled.

To mark an Indicator as private when doing an unstructured import (see Unstructured Indicator Import), click the checkbox in the Indicator’s Private column on the Validate tab of the Import Indicators - Unstructured screen (Figure 6). This column will be present only if private Indicators have been enabled.

Email Import

To mark an Indicator as private when using the email import feature (see Email Import), hover the cursor over the Indicator as listed in the header or body of the email on the Indicators tab of the Import E-mail wizard. A small pop-up window will appear under the Indicator (Figure 7). Click the Private checkbox to mark the Indicator as private. This checkbox will be present only if private Indicators have been enabled.



CAL is a trademark of ThreatConnect, Inc.

20053-05 EN Rev. C

Contact Us

  • ThreatConnect, Inc.
    3865 Wilson Blvd.
    Suite 550
    Arlington, VA 22203

    Toll Free:   1.800.965.2708
    Local: +1.703.229.4240
    Fax +1.703.229.4489

    Email Us



https://cdn.desk.com/
false
desk
Loading
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
about
false
Invalid characters found
/customer/en/portal/articles/autocomplete