Private Indicators
  • 09 May 2023
  • 2 Minutes to read
  • Dark
    Light

Private Indicators

  • Dark
    Light

Article summary

Overview

CAL™ provides anonymized, crowdsourced intelligence derived from global data for an Indicator across all participating instances of ThreatConnect®. Customers using an On-Premises or Dedicated Cloud instance of ThreatConnect may disable CAL data retrieval for individual Indicators by marking that Indicator as private.

To have the option to mark Indicators as private in the user interface as described throughout this article, a System Administrator must enable private Indicators for your ThreatConnect instance. Indicators marked as private will neither send data to CAL nor receive data from CAL. To view CAL Insights for an Indicator, do not mark it as private.

Before You Start

Minimum Role(s)Organization role of Standard User
PrerequisitesPrivate Indicators enabled by a System Administrator

Marking an Indicator as Private

You can mark Indicators as private in five locations in ThreatConnect.

The Details Screen

New Details Screen

  1. Navigate to the Details screen for an Indicator.
  2. On the Overview tab, select the Private checkbox at the upper-right corner of the Details card to mark the Indicator as private (Figure 1). Figure 1_Private Indicators_7.1.0

     

    Note
    You can change an Indicator from private to public by clearing the Private checkbox.
    Note
    If an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using Threat Graph.

Legacy Details Screen

  1. Navigate to the legacy Details screen for an Indicator.
  2. If private Indicators are enabled, a checkbox labeled Private will be displayed on the right side of the Indicator Analytics card (Figure 2).

    Figure 2_Private Indicators_7.1.0

     

  3. Select the Private checkbox to mark the Indicator as private. After you select the Private checkbox, the Indicator Analytics card will display no CAL data (Figure 3).

    Figure 3_Private Indicators_7.1.0

     

    Note
    You can change an Indicator from private to public by clearing the Private checkbox.
    Note
    If an Indicator is marked as private, you will not be able to pivot within a CAL dataset for the Indicator when using Threat Graph.

The Create Indicator Window

To mark an Indicator as private when creating it via the Create option on the top navigation bar, select the Private checkbox in the Create window for the selected Indicator type (Figure 4).

Figure 4_Private Indicators_7.1.0

 

The Create Group Screen

To mark an Indicator as private when creating a new Group and associating Indicators to it via the Create option on the top navigation bar, select the checkbox in the Indicator’s Private column in the Associations table on the Associations section of the Create screen (Figure 5).

Graphical user interface, application  Description automatically generated

 

Indicator Import

To mark an Indicator as private when performing a structured Indicator import, select the checkbox in the Indicator’s Private column on the Confirm step of the Import Indicators - Structured screen (Figure 6).

 

To mark an Indicator as private when performing an unstructured Indicator import, select the checkbox in the Indicator’s Private column on the Validate step of the Import Indicators - Unstructured screen (Figure 7).

Graphical user interface, application  Description automatically generated

 

Email Import

To mark an Indicator as private when using the email import feature, hover over the highlighted Indicator in the header or body of the email on the Indicators step of the Import E-mail screen. A small window will be displayed below the Indicator with a Private checkbox and ADD INDICATOR button. Select the Private checkbox to mark the Indicator as private (Figure 8).

 


ThreatConnect® is a registered trademark, and CAL is a trademark, of ThreatConnect, Inc.

20066-01 v.03.A


Was this article helpful?