CAL ATL Industry Classification

Overview

The CAL™ Automated Threat Library (ATL) is designed to help organizations streamline their cybersecurity intelligence efforts by processing and organizing essential open-source intelligence (OSINT) information into machine-readable components that can be leveraged throughout ThreatConnect®. The sheer volume of data available can be overwhelming and difficult to sift through, but CAL ATL industry classification can help by using natural language processing (NLP) to classify ATL Reports by industry. The industry classifications are available as standard Tags that can be applied to ThreatConnect objects such as Groups. They are also provided as keyword suggestions for Intelligence Requirements (IRs).

Before You Start

User Roles

• To view and pivot on CAL ATL industry classification Tags, your user account can have any Organization role.
• To view IR results and CAL ATL Reports, your user account can have any Organization role.
• To add CAL ATL industry classification Tags to objects, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.
• To use suggested CAL ATL industry classification keywords when creating or editing an IR, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator.

Prerequisites

To use CAL ATL industry classifications:

• Activate the CAL Automated Threat Library feed if it is not already activated (must be a System Administrator to perform this action).
• Verify your ThreatConnect instance can receive data from cal.threatconnect.com (if using an On-Premises instance).

How Are ATL Reports Classified by Industry?

The CAL ATL uses natural language processing (NLP) to review the contents of ATL Reports and identify which industries are most relevant to each Report, according to the U.S. Census Bureau’s 2022 (most recent) North American Industry Classification System (NAICS). Each Report is then associated to standard Tags representing  the two- and three-digit NAICS codes that correspond to its industries (Figure 1). You can use the Tags to make quick decisions when selecting and excluding ATL resources, enabling you to focus on other tasks in ThreatConnect, such as building your IRs, browsing, and searching.

Table 1 lists the NAICS codes used in the CAL ATL industry classification framework. The two-digit codes, representing industry sectors, have a wider range of associated Reports than the three-digit codes, which represent industry subsectors.

How Can I Use CAL ATL Industry Classification?

CAL ATL Report Groups and Tags

You can use CAL ATL industry classification Tags associated with a CAL ATL Report Groups to pivot to other blogs associated with those industry categories. For example, if you view the Details screen for a CAL ATL Report, you can click on one of its industry classification Tags to view the Tag’s Details screen, which will show all other ATL Reports that are associated to the Tag in the Associated Groups section on the Associations card (Figure 2).

You can also view and pivot on these associations in Threat Graph (Figure 3).

Intelligence Requirements

Industry Keyword Suggestions

You can leverage CAL ATL industry classification when creating and editing IRs by including or excluding NAICS keyword suggestions, which are determined by the information entered in the Requirement field for the IR (Figure 4).

After you create your IR, you can add CAL ATL industry classification Tags to it based on the corresponding NAICS keyword suggestions for the IR. 

Intelligence Requirement Global Results

If you include NAICS keyword suggestions for an IR, the IR’s Global results will include ATL Reports that have CAL ATL industry classification Tags corresponding to those keyword suggestions, representing a set of Reports broadly associated with those industry terms that you can investigate.

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20163-01 v.01.A