--- title: "Private Indicators | ThreatConnect" slug: "private-indicators" description: "This article describes how to mark an Indicator as private in ThreatConnect." tags: ["Enriching Data"] updated: 2023-05-09T13:18:44Z published: 2023-05-09T13:18:44Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Private Indicators ## Overview [CAL](https://knowledge.threatconnect.com/docs/threatassess-and-cal)™ provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect®. Customers using an On-Premises or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private. To have the option to mark Indicators as private in the user interface as described throughout this article, a System Administrator must enable private Indicators for your ThreatConnect instance. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | Private Indicators enabled by a System Administrator | ## Marking an Indicator as Private You can mark Indicators as private in five locations in ThreatConnect. ### The Details Screen #### New Details Screen 1. [Navigate to the **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) for an Indicator. 2. On the **Overview**tab, select the **Private**checkbox at the upper-right corner of the **Details**card to mark the Indicator as private (Figure 1). ![Figure 1_Private Indicators_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Private%20Indicators_7.1.0.png) NoteYou can change an Indicator from private to public by clearing the **Private**checkbox.NoteIf an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using [Threat Graph](https://knowledge.threatconnect.com/docs/explore-in-graph). #### Legacy Details Screen 1. [Navigate to the legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for an Indicator. 2. If private Indicators are enabled, a checkbox labeled **Private** will be displayed on the right side of the **Indicator Analytics**card (Figure 2). ![Figure 2_Private Indicators_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Private%20Indicators_7.1.0.png) 3. Select the **Private**checkbox to mark the Indicator as private. After you select the **Private** checkbox, the **Indicator Analytics**card will display no CAL data (Figure 3). ![Figure 3_Private Indicators_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Private%20Indicators_7.1.0.png) NoteYou can change an Indicator from private to public by clearing the **Private**checkbox.NoteIf an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using [Threat Graph](https://knowledge.threatconnect.com/docs/explore-in-graph). ### The Create Indicator Window To mark an Indicator as private when creating it via the [**Create**](/docs/create)****option on the top navigation bar, select the **Private** checkbox in the **Create**window for the selected Indicator type (Figure 4). ![Figure 4_Private Indicators_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Private%20Indicators_7.1.0.png) ### The Create Group Screen To mark an Indicator as private when creating a new Group and associating Indicators to it via the **Create**option on the top navigation bar, select the checkbox in the Indicator’s **Private** column in the **Associations** table on the **Associations** section of the **Create**screen (Figure 5). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Private%20Indicators_7.1.0.png) ### Indicator Import To mark an Indicator as private when performing a [structured Indicator import](/docs/structured-indicator-import), select the checkbox in the Indicator’s **Private** column on the **Confirm** step of the **Import Indicators - Structured**screen (Figure 6). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Private%20Indicators_7.1.0.png) To mark an Indicator as private when performing an [unstructured Indicator import](/docs/unstructured-indicator-import), select the checkbox in the Indicator’s **Private** column on the **Validate** step of the **Import Indicators - Unstructured**screen (Figure 7). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_Private%20Indicators_7.1.0.png) ### Email Import To mark an Indicator as private when using the [email import feature](https://knowledge.threatconnect.com/docs/email-import), hover over the highlighted Indicator in the header or body of the email on the **Indicators** step of the **Import E-mail**screen. A small window will be displayed below the Indicator with a **Private**checkbox and **ADD INDICATOR**button. Select the **Private** checkbox to mark the Indicator as private (Figure 8). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_Private%20Indicators_7.1.0.png) --- *ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.* 20066-01 v.03.A ## Related - [Email Import](/email-import.md) - [Structured Indicator Import](/structured-indicator-import.md) - [The Details Screen](/the-details-screen.md) - [ThreatAssess and CAL](/threatassess-and-cal.md) - [Unstructured Indicator Import](/unstructured-indicator-import.md)