Private Indicators

Overview

CAL™ provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect^®. Customers using an On-Premises or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private.

To have the option to mark Indicators as private in the user interface as described throughout this article, a System Administrator must enable private Indicators for your ThreatConnect instance. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private.

Before You Start

Marking an Indicator as Private

You can mark Indicators as private in five locations in ThreatConnect.

The Details Screen

New Details Screen

1. Navigate to the Details screen for an Indicator.
2. On the Overview tab, select the Private checkbox at the upper-right corner of the Details card to mark the Indicator as private (Figure 1). 

    

   Note

   You can change an Indicator from private to public by clearing the Private checkbox.
   Note

   If an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using Threat Graph.

Legacy Details Screen

1. Navigate to the legacy Details screen for an Indicator.
2. If private Indicators are enabled, a checkbox labeled Private will be displayed on the right side of the Indicator Analytics card (Figure 2).

   

    

3. Select the Private checkbox to mark the Indicator as private. After you select the Private checkbox, the Indicator Analytics card will display no CAL data (Figure 3).

   

    

   Note

   You can change an Indicator from private to public by clearing the Private checkbox.
   Note

   If an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using Threat Graph.

The Create Indicator Window

To mark an Indicator as private when creating it via the Create option on the top navigation bar, select the Private checkbox in the Create window for the selected Indicator type (Figure 4).

The Create Group Screen

To mark an Indicator as private when creating a new Group and associating Indicators to it via the Create option on the top navigation bar, select the checkbox in the Indicator’s Private column in the Associations table on the Associations section of the Create screen (Figure 5).

Indicator Import

To mark an Indicator as private when performing a structured Indicator import, select the checkbox in the Indicator’s Private column on the Confirm step of the Import Indicators - Structured screen (Figure 6).

To mark an Indicator as private when performing an unstructured Indicator import, select the checkbox in the Indicator’s Private column on the Validate step of the Import Indicators - Unstructured screen (Figure 7).

Email Import

To mark an Indicator as private when using the email import feature, hover over the highlighted Indicator in the header or body of the email on the Indicators step of the Import E-mail screen. A small window will be displayed below the Indicator with a Private checkbox and ADD INDICATOR button. Select the Private checkbox to mark the Indicator as private (Figure 8).

ThreatConnect^® is a registered trademark, and CAL^™ is a trademark, of ThreatConnect, Inc.

20066-01 v.03.A