CAL ATL Industry Classification
  • 25 Apr 2024
  • 6 Minutes to read
  • Dark

CAL ATL Industry Classification

  • Dark

Article summary


The CAL™ Automated Threat Library (ATL) is designed to help organizations streamline their cybersecurity intelligence efforts by processing and organizing essential open-source intelligence (OSINT) information into machine-readable components that can be leveraged throughout ThreatConnect®. The sheer volume of data available can be overwhelming and difficult to sift through, but CAL ATL industry classification can help by using natural language processing (NLP) to classify ATL Reports by industry. The industry classifications are available as standard Tags that can be applied to ThreatConnect objects such as Groups. They are also provided as keyword suggestions for Intelligence Requirements (IRs).

Before You Start

User Roles

  • To view and pivot on CAL ATL industry classification Tags, your user account can have any Organization role.
  • To view IR results and CAL ATL Reports, your user account can have any Organization role.
  • To add CAL ATL industry classification Tags to objects, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.
  • To use suggested CAL ATL industry classification keywords when creating or editing an IR, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.


To use CAL ATL industry classifications:

  • Activate the CAL Automated Threat Library feed if it is not already activated (must be a System Administrator to perform this action).
  • Verify your ThreatConnect instance can receive data from (if using an On-Premises instance).

How Are ATL Reports Classified by Industry?

The CAL ATL uses natural language processing (NLP) to review the contents of ATL Reports and identify which industries are most relevant to each Report, according to the U.S. Census Bureau’s 2022 (most recent) North American Industry Classification System (NAICS). Each Report is then associated to standard Tags representing  the two- and three-digit NAICS codes that correspond to its industries (Figure 1). You can use the Tags to make quick decisions when selecting and excluding ATL resources, enabling you to focus on other tasks in ThreatConnect, such as building your IRs, browsing, and searching.

Figure 1_CAL ATL Industry Classification_7.5.1


Table 1 lists the NAICS codes used in the CAL ATL industry classification framework. The two-digit codes, representing industry sectors, have a wider range of associated Reports than the three-digit codes, which represent industry subsectors.


NAICS SectorNAICS Subsector
NAICS: 11 - Agriculture, Forestry, Fishing and HuntingNAICS: 111 - Crop Production
NAICS: 112 - Animal Production and Aquaculture
NAICS: 113 - Forestry and Logging
NAICS: 114 - Fishing, Hunting and Trapping
NAICS: 115 - Support Activities for Agriculture and Forestry
NAICS: 21 - Mining, Quarrying, Oil and Gas ExtractionNAICS: 211 - Oil and Gas Extraction
NAICS: 212 - Mining (except Oil and Gas)
NAICS: 213 - Support Activities for Mining
NAICS: 22 - UtilitiesNAICS: 221 - Utilities
NAICS: 23 - ConstructionNICAS: 236 - Construction of Buildings
NAICS: 237 - Heavy and Civil Engineering Construction
NAICS: 238 - Specialty Trade Contractors
NAICS: 31 - Manufacturing - Food and TextileNAICS: 311 - Food Manufacturing
NAICS: 312 - Beverage and Tobacco Product Manufacturing
NAICS: 313 - Textile Mills
NAICS: 314 - Textile Product Mills
NAICS: 315 - Apparel Manufacturing
NAICS: 316 - Leather and Allied Product Manufacturing
NAICS: 32 - Manufacturing - Wood and PlasticsNAICS: 321 - Wood Product Manufacturing
NAICS: 322 - Paper Manufacturing
NAICS: 323 - Printing and Related Support Activities
NAICS: 324 - Petroleum and Coal Products Manufacturing
NAICS: 325 - Chemical Manufacturing
NAICS: 326 - Plastics and Rubber Products Manufacturing
NAICS: 327 - Nonmetallic Mineral Product Manufacturing
NAICS: 33 - Manufacturing - Metal, Electronics and OtherNAICS: 331 - Primary Metal Manufacturing
NAICS: 332 - Fabricated Metal Product Manufacturing
NAICS: 333 - Machinery Manufacturing
NAICS: 334 - Computer and Electronic Product Manufacturing
NAICS: 335 - Electrical Equipment, Appliance, Component Manufacturing
NAICS: 336 - Transportation Equipment Manufacturing
NAICS: 337 - Furniture and Related Product Manufacturing
NAICS: 339 - Miscellaneous Manufacturing
NAICS: 42 - Wholesale TradeNAICS: 423 - Merchant Wholesalers, Durable Goods
NAICS: 424 - Merchant Wholesalers, Nondurable Goods
NAICS: 425 - Wholesale Trade Agents and Brokers
NAICS: 44 - Retail Trade - Auto, Food, HomeNAICS: 441 - Motor Vehicle and Parts Dealers
NAICS: 444 - Building Material and Garden Equipment and Supplies Dealers
NAICS: 445 - Food and Beverage Retailers
NAICS: 449 - Furniture, Home Furnishings, Electronics, Appliance Retailers
NAICS: 45 - Retail Trade - Fuel, OtherNAICS: 455 - General Merchandise Retailers
NAICS: 456 - Health and Personal Care Retailers
NAICS: 457 - Gasoline Stations and Fuel Dealers
NAICS: 458 - Clothing, Clothing Accessories, Shoe, Jewelry Retailers
NAICS: 459 - Sporting Goods, Hobby, Musical Instrument, Book, Miscellaneous Retailers
NAICS: 48 - TransportationNAICS: 481 - Air Transportation
NAICS: 482 - Rail Transportation
NAICS: 483 - Water Transportation
NAICS: 484 - Truck Transportation
NAICS: 485 - Transit and Ground Passenger Transportation
NAICS: 486 - Pipeline Transportation
NAICS: 487 - Scenic and Sightseeing Transportation
NAICS: 488 - Support Activities for Transportation
NAICS: 49 - Couriers and WarehousingNAICS: 491 - Postal Service
NAICS: 492 - Couriers and Messengers
NAICS: 493 - Warehousing and Storage
NAICS: 51 - InformationNAICS: 512 - Motion Picture and Sound Recording Industries
NAICS: 513 - Publishing Industries
NAICS: 516 - Broadcasting and Content Providers
NAICS: 517 - Telecommunications
NAICS: 518 - Computing Infrastructure Providers, Data Processing, Web Hosting, Related Services
NAICS: 519 - Web Search Portals, Libraries, Archives, Other Information Services
NAICS: 52 - Finance and InsuranceNAICS: 521 - Monetary Authorities-Central Bank
NAICS: 522 - Credit Intermediation and Related Activities
NAICS: 523 - Securities, Commodity Contracts, Other Financial Investments and Related Activities
NAICS: 524 - Insurance Carriers and Related Activities
NAICS: 525 - Funds, Trusts, Other Financial Vehicles
NAICS: 53 - Real Estate and Rental and LeasingNAICS: 531 - Real Estate
NAICS: 532 - Rental and Leasing Services
NAICS: 533 - Lessors of Nonfinancial Intangible Assets (except Copyrighted Works)
NAICS: 54 - Professional, Scientific, Technical ServicesNAICS: 541 - Professional, Scientific, Technical Services
NAICS: 55 - Management of Companies and EnterprisesNAICS: 551 - Management of Companies and Enterprises
NAICS: 56 - Administrative and Support and Waste Management and Remediation ServicesNAICS: 561 - Administrative and Support Services
NAICS: 562 - Waste Management and Remediation Services
NAICS: 61 - Educational ServicesNAICS: 611 - Educational Services
NAICS: 62 - Health Care and Social AssistanceNAICS: 621 - Ambulatory Health Care Services
NAICS: 622 - Hospitals
NAICS: 623 - Nursing and Residential Care Facilities
NAICS: 624 - Social Assistance
NAICS: 71 - Arts, Entertainment, RecreationNAICS: 711 - Performing Arts, Spectator Sports, Related Industries
NAICS: 712 - Museums, Historical Sites, Similar Institutions
NAICS: 713 - Amusement, Gambling, Recreation Industries
NAICS: 72 - Accommodation and Food ServicesNAICS: 721 - Accommodation
NAICS: 722 - Food Services and Drinking Places
NAICS: 81 - Other Services (except Public Administration)NAICS: 811 - Repair and Maintenance
NAICS: 812 - Personal and Laundry Services
NAICS: 813 - Religious, Grantmaking, Civic, Professional, Similar Organizations
NAICS: 814 - Private Households
NAICS: 92 - Public AdministrationNAICS: 921 - Executive, Legislative, Other General Government Support
NAICS: 922 - Justice, Public Order, Safety Activities
NAICS: 923 - Administration of Human Resource Programs
NAICS: 924 - Administration of Environmental Quality Programs
NAICS: 925 - Administration of Housing Programs, Urban Planning, Community Development
NAICS: 926 - Administration of Economic Programs
NAICS: 927 - Space Research and Technology
NAICS: 928 - National Security and International Affairs

How Can I Use CAL ATL Industry Classification?

CAL ATL Report Groups and Tags

You can use CAL ATL industry classification Tags associated with a CAL ATL Report Groups to pivot to other blogs associated with those industry categories. For example, if you view the Details screen for a CAL ATL Report, you can click on one of its industry classification Tags to view the Tag’s Details screen, which will show all other ATL Reports that are associated to the Tag in the Associated Groups section on the Associations card (Figure 2).

Figure 2_CAL ATL Industry Classification_7.5.1


You can also view and pivot on these associations in Threat Graph (Figure 3).

Figure 3_CAL ATL Industry Classification_7.5.1


Intelligence Requirements

Industry Keyword Suggestions

You can leverage CAL ATL industry classification when creating and editing IRs by including or excluding NAICS keyword suggestions, which are determined by the information entered in the Requirement field for the IR (Figure 4).

Figure 4_CAL ATL Industry Classification_7.5.1


After you create your IR, you can add CAL ATL industry classification Tags to it based on the corresponding NAICS keyword suggestions for the IR. 

Intelligence Requirement Global Results

If you include NAICS keyword suggestions for an IR, the IR’s Global results will include ATL Reports that have CAL ATL industry classification Tags corresponding to those keyword suggestions, representing a set of Reports broadly associated with those industry terms that you can investigate.

If another user has changed or removed a CAL ATL industry classification Tag from a CAL ATL Report, the Report will still be provided as a Global result for an IR that includes the NAICS keyword suggestion corresponding to the changed or removed Tag.

ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20163-01 v.01.A

Was this article helpful?