System Indicator Confidence Deprecation

Overview

System Indicator confidence deprecation rules do not themselves apply to data in any owner. Instead, they can serve two purposes:

• System Indicator confidence deprecation rules can be used as templates when creating a confidence deprecation rule in an Organization, Community, or Source.
• System Indicator confidence deprecation rules can be configured as default deprecation rules in newly created Organizations, Communities, and/or Sources.

Before You Start

User Roles

• To view System Indicator confidence deprecation rules, you must have a System role of Administrator, Operations Administrator, Accounts Administrator, or Community Leader.
• To create and configure System Indicator confidence deprecation rules, you must have a System role of Administrator or Operations Administrator.

Viewing System Indicator Confidence Deprecation Rules

Follow these steps to view the System Indicator confidence deprecation rules on your ThreatConnect instance:

1. Hover over Settingson the top navigation bar and select Account Settings.
2. Select the Deprecation Rules tab on the Account Settings screen. All System Indicator confidence deprecation rules on your ThreatConnect instance will be displayed in a table with the following columns (Figure 1): 

    

   • Name: The name of the deprecation rule.
   • Applies to Community: If this rule is applied as a default deprecation rule in newly created Communities, the value in this column will be true.
   • Applies to Source: If this rule is applied as a default deprecation rule in newly created Sources, the value in this column will be true.
   • Applies to Org: If this rule is applied as a default deprecation rule in newly created Organizations, the value in this column will be true.
   • Indicator Type: The Indicator type to which the deprecation rule applies.
   • Interval: The number of days after which an Indicator’s Confidence Rating should decrease if it has not been updated.
   • Amount: The amount by which an Indicator’s Confidence Rating should decrease if it has not been updated during the specified interval.
   • Percentage: If this checkbox is selected, the specified amount should be applied as a percentage of an Indicator’s Confidence Rating (e.g., if the amount is 2, then the Indicator’s Confidence Rating will be decreased by 2% after the specified interval). If this checkbox is cleared, the specified amount should be applied directly (e.g., if the amount is 2, then the Indicator’s Confidence Rating will be decreased by 2 points after the specified interval).
   • Recurring: If this checkbox is selected, the deprecation rule will be applied on a recurring basis. If this checkbox is cleared, the deprecation rule will be applied only once.
   • Action at Minimum: The value in this column specifies the action that will be taken if an Indicator’s Confidence Rating drops to 0.
   • Options: Use the options in this column to edit or delete a deprecation rule.

Creating System Indicator Confidence Deprecation Rules

Follow these steps to create and configure a System Indicator confidence deprecation rule:

1. Hover over Settingson the top navigation bar and select Account Settings.
2. Select the Deprecation Rules tab on the Account Settings screen (Figure 1).
3. Click + NEW at the top left of the Deprecation Rules screen.
4. Fill out the fields on the Create/Edit System Deprecation Rule window (Figure 2) as follows: 

    

   • Name: Enter a name for the deprecation rule. This name will be displayed in the table on the Deprecation Rules tab of the Account Settings screen and when selecting a deprecation rule to apply as a template in an Organization, Community, or Source.
   • Description: Enter a description for the deprecation rule.
   • Indicator Type: Select the Indicator type to which the deprecation rule will apply.
   • Confidence: Enter the amount by which the Confidence Rating for Indicators of the selected type should decrease if they have not been updated during the specified Interval.
   • Percentage: (Optional) Select this checkbox to use the Confidence parameter as a percentage instead of a numerical value. For example, if the Confidence parameter is 5 and the Percentage checkbox is cleared, the Confidence Rating will drop by 5 points (e.g., from 60 to 55) when it is deprecated. If the Confidence parameter is 5 and the Percentagecheckbox is selected, the Confidence Rating will drop by 5% (e.g., from 60 to 57).
     Note

     When a percentage corresponds to a fractional number of points, the final result will be rounded to the nearest whole number. For example, a Confidence Rating of 35 being deprecated by 4% (1.4 points) will be calculated as 33.6 and then rounded up to 34. If that value is the same as the original Confidence Rating, then the value will be decreased by 1. For example, a Confidence Rating of 2 being deprecated by 2% (0.04 points) will be calculated as 1.96 and then finalized as 1.
   • Action at Minimum: Select one of the following actions to take when the Confidence Rating for an Indicator of the selected type drops to 0:
     • None: Select this option to take no action when the Confidence Rating for an Indicator of the selected type drops to 0.
     • Set Inactive: Select this option to set the status of an Indicator of the selected type to inactive when its Confidence Rating drops to 0. When this option is selected, a CAL Status Lock checkbox will be displayed. Select this checkbox to prevent CAL™ from changing the Indicator’s status back to active at any point.
     • Delete: Select this option to delete an Indicator of the selected type from the owner when its Confidence Rating drops to 0.
   • Interval: Enter the number of days after which the Confidence Rating should decrease if it has not been updated.
   • Recurring: (Optional) Select this checkbox for the deprecation rule to be applied on a recurring basis instead of just once.
   • Initialize Deprecation from: Select one of the following initialization points for the deprecation rule:
     • Last Modified Date: Select this option to initialize confidence deprecation from the date when each Indicator of the selected type in the owner was last modified. For each existing Indicator, confidence deprecation will occur retroactively from its “last modified” date.
     • Time of Save: Select this option to initialize confidence deprecation from the time the rule is created and saved in an owner. For all existing Indicators, confidence deprecation will occur from that time.
   • Apply to New: (Optional) Select the checkbox for each owner type in which to apply this deprecation rule as a default deprecation rule in newly created owners:
     • Organizations: (Optional) Select this checkbox to apply this rule as a default deprecation rule in newly created Organizations. When a new Organization is created, this rule will be automatically created and saved on the Deprecation Rules tab of the Organization Config screen for the Organization.
     • Communities: (Optional) Select this checkbox to apply this rule as a default deprecation rule in newly created Communities. When a new Community is created, this rule will be automatically created and saved on the Deprecation Rules tab of the Community Config screen for the Community.
     • Sources: (Optional) Select this checkbox to apply this rule as a default deprecation rule in newly created Sources. When a new Source is created, this rule will be automatically created and saved on the Deprecation Rules tab of the Source Config screen for the Source.
5. Click SAVE on the Create/Edit System Deprecation Rule window to save the deprecation rule.

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20039-02 v.14.A