NAICS AI Industry Classification

Overview

The NAICS AI industry classification functionality in ThreatConnect®, powered by the CAL™ Doc Analysis Service, uses natural language processing (NLP) to identify relevant industries from text and classify the input according to the U.S. Census Bureau’s 2022 (most recent) North American Industry Classification System (NAICS) codes. The industry classifications are captured in standard Tags representing identified NAICS sectors and subsectors (“NAICS Tags”). NAICS AI industry classification can be leveraged in the CAL Automated Threat Library Source, Intelligence Requirements (IRs), and the ThreatConnect Doc Analysis Playbook App.

Before You Start

User Roles

• To view and pivot on NAICS Tags, your user account can have any Organization role.
• To view CAL ATL Reports, your user account can have any Organization role.
• To view IRs and IR results, your user account can have any Organization role.
• To add NAICS Tags to objects, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.
• To apply suggested NAICS-specific keywords when creating or editing an IR, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.
• To configure and execute Playbooks, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.

Prerequisites

• Turn on the CAL Automated Threat Library feed on the Feeds tab of the TC Exchange™ Settings screen (must be a System Administrator to perform this action).
• To have access to Playbooks on your ThreatConnect instance, turn on the playbooksEnabled system setting (must be a System Administrator to perform this action).
• To have access to Playbooks in your Organization, turn on the Enable Playbooks permission on the Permissions tab of the Organization Information window when editing your Organization on the Organizations tab of the Account Settings screen (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action).
• To allow the ThreatConnect Doc Analysis Playbook App to identify and output NAICS codes, verify that your ThreatConnect instance can receive data from CAL (if using an On Premises instance) by ensuring that the CALHost system setting has a value of cal.threatconnect.com (must be a System Administrator to perform this action).

NAICS Codes

The ThreatConnect NAICS AI industry classification feature recognizes 120 two- and three-digit NAICS codes and their corresponding industry sectors and subsectors, respectively (Table 1).

NAICS Tags

The NAICS AI industry classification feature leverages a set of standard Tags that represent the available NAICS codes and their corresponding industry sectors and subsectors, respectively. These NAICS Tags are owned by the CAL Automated Threat Library Source and are formatted as NAICS: <sector or subsector number> - <sector or subsector name>, as in the following examples:

• NAICS: 52 - Finance And Insurance
• NAICS: 524 - Insurance Carriers and Related Activities

You can see all available NAICS Tags by filtering the Search: Tags screen by the “naics” keyword (Figure 1).

CAL Automated Threat Library

The CAL Automated Threat Library (ATL) is designed to help you streamline your cybersecurity intelligence efforts by processing and organizing essential open-source intelligence (OSINT) information into machine-readable components that can be leveraged throughout ThreatConnect. Because the sheer volume of data available can be overwhelming and difficult to sift through, ThreatConnect uses NAICS AI industry classification to automatically add NAICS Tags to Report Groups in the CAL Automated Threat Library Source (“CAL ATL Reports”), based on industry information identified in the Name/Summary and Description of each Group.

You can leverage NAICS Tags to help you make quick decisions when selecting and excluding resources, allowing you to work more efficiently. You can also use NAICS Tags as avenues for related or further research by pivoting to blogs and reports covering the same industry. For example, if you’re looking at a CAL ATL Report on spam attacks targeting online music platforms and want to see what other information exists on threats to the music industry, you can go to the Details screen for the NAICS: 512 – Motion Picture and Sound Recording Industries Tag applied to that Report and check out all other CAL ATL Reports with that Tag listed in the Associated Groups section of the Associations card. You can also view and pivot on these associations in Threat Graph.

Intelligence Requirements

Intelligence Requirements (IRs) leverage NAICS AI industry classification by providing NAICS-specific keyword suggestions based on the text entered in the Requirement field for an IR (Figure 2). You can include or exclude these suggestions to focus the results returned by the IR.

After you save your IR, you can add NAICS Tags corresponding to the included NAICS-specific keywords to the IR itself. To do so, view the selected NAICS-specific keywords in the Keyword Tracking section of the Keyword Tracking & Results card on the IR's Details screen and add  the corresponding NAICS Tags in the Tags section of the Details card (Figure 3).

The IR’s global results set will include CAL ATL Reports that are broadly associated with the industries in the included NAICS-specific keywords, providing you with related material for further investigation. These results will be included even if your user account does not have access to the CAL Automated Threat Library Source. If your user account does have access to the CAL Automated Threat Library Source, the IR’s global results set will also include CAL ATL Reports that CAL has labeled as relevant to the included NAICS-specific and related keywords.

ThreatConnect Doc Analysis Playbook App

When using the ThreatConnect Doc Analysis Playbook App to import data into ThreatConnect, you can select the AI NAICS Industry Classification feature (Figure 4) to analyze the text input passed to the App and output an array of identified NAICS codes (tc.naics.codes) that may be passed to downstream Apps for further analysis and enrichment.

ThreatConnect^® is a registered trademark, and CAL™ and TC Exchange™ are trademarks, of ThreatConnect, Inc.

20163-01 v.02.A