Private Indicators
  • 28 Nov 2022
  • 2 Minutes to read
  • Dark
    Light

Private Indicators

  • Dark
    Light

Minimum Role: Organization role of Standard User

Prerequisites: Private Indicators enabled by a System Administrator

Overview

The ThreatConnect® Collective Analytics Layer (CAL) provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect. Customers using an On-Premises or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private.

To have the option to mark Indicators as private in the user interface as described throughout this article, a System Administrator must enable private Indicators in your ThreatConnect instance. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private.

Marking an Indicator as Private

You can mark Indicators as private in five locations in ThreatConnect.

The Details Screen

  1. Navigate to an Indicator’s Details screen. For instructions on accessing an Indicator’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.
  2. If private Indicators are enabled, a checkbox labeled Private will be displayed on the right side of the Indicator Analytics card (Figure 1).

    Graphical user interface, application  Description automatically generated

     

  3. Select the Private checkbox to mark the Indicator as private.

After you select the Private checkbox, the Indicator Analytics card will display no CAL data, and data on the Indicator will not be sent to CAL for aggregation (Figure 2).

Timeline  Description automatically generated

 

Note
You can change an Indicator from private to public by clearing the Private checkbox.
Note
If an Indicator is marked as private, you will not be able to explore Indicator relationships that exist in CAL when using the Explore In Graph feature.

The Create Indicator Window

To mark an Indicator as private when creating it via the Create option on the top navigation bar, select the Private checkbox in the Create window for the selected Indicator type (Figure 3).

 

The Create Group Screen

To mark an Indicator as private when creating a new Group and associating Indicators to it via the Create option on the top navigation bar, select the checkbox in the Indicator’s Private column in the Associations table on the Associations section of the Create screen (Figure 4).

Graphical user interface, application  Description automatically generated

 

Indicator Import

To mark an Indicator as private when performing a structured Indicator import, select the checkbox in the Indicator’s Private column on the Confirm step of the Import Indicators - Structured screen (Figure 5).

 

To mark an Indicator as private when performing an unstructured Indicator import, select the checkbox in the Indicator’s Private column on the Validate step of the Import Indicators - Unstructured screen (Figure 6).

Graphical user interface, application  Description automatically generated

 

Email Import

To mark an Indicator as private when using the email import feature, hover the cursor over the highlighted Indicator in the header or body of the email on the Indicators step of the Import E-mail screen. A small window will be displayed below the Indicator with a Private checkbox and ADD INDICATOR button. Select the Private checkbox to mark the Indicator as private (Figure 7).

 


ThreatConnect® is a registered trademark of ThreatConnect, Inc.
CAL is a trademark of ThreatConnect, Inc.

20066-01 v.02.C


Was this article helpful?