Private Indicators

Minimum Role: Organization role of Standard User

Prerequisites: Private Indicators enabled by a System Administrator

Overview

The ThreatConnect^® Collective Analytics Layer (CAL^™) provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect. Customers using an On-Premises or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private.

To have the option to mark Indicators as private in the user interface as described throughout this article, a System Administrator must enable private Indicators in your ThreatConnect instance. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private.

Marking an Indicator as Private

You can mark Indicators as private in five locations in ThreatConnect.

The Details Screen

1. Navigate to an Indicator’s Details screen. For instructions on accessing an Indicator’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.
2. If private Indicators are enabled, a checkbox labeled Private will be displayed on the right side of the Indicator Analytics card (Figure 1).

   

    

3. Select the Private checkbox to mark the Indicator as private.

After you select the Private checkbox, the Indicator Analytics card will display no CAL data, and data on the Indicator will not be sent to CAL for aggregation (Figure 2).

The Create Indicator Window

To mark an Indicator as private when creating it via the Create option on the top navigation bar, select the Private checkbox in the Create window for the selected Indicator type (Figure 3).

The Create Group Screen

To mark an Indicator as private when creating a new Group and associating Indicators to it via the Create option on the top navigation bar, select the checkbox in the Indicator’s Private column in the Associations table on the Associations section of the Create screen (Figure 4).

Indicator Import

To mark an Indicator as private when performing a structured Indicator import, select the checkbox in the Indicator’s Private column on the Confirm step of the Import Indicators - Structured screen (Figure 5).

To mark an Indicator as private when performing an unstructured Indicator import, select the checkbox in the Indicator’s Private column on the Validate step of the Import Indicators - Unstructured screen (Figure 6).

Email Import

To mark an Indicator as private when using the email import feature, hover the cursor over the highlighted Indicator in the header or body of the email on the Indicators step of the Import E-mail screen. A small window will be displayed below the Indicator with a Private checkbox and ADD INDICATOR button. Select the Private checkbox to mark the Indicator as private (Figure 7).

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
CAL^™ is a trademark of ThreatConnect, Inc.

20066-01 v.02.C