Cyware Situational Awareness Platform

ATT&CK Matrix

Choose from Enterprise, Mobile, or ICS in the MITRE ATT&CK framework to filter alerts. This filter is available only if the feature is enabled. For more information, see Configure Collaborate Features.

Announcement Type

Choose from predefined announcement types such as Report, Information, News, Advisory, or more to filter alerts.

Campaign

Choose from available campaigns to filter alerts associated with specific threat campaigns.

Category

Choose one or more system-defined or custom categories to filter alerts.

Confidence

Choose confidence levels to filter alerts based on the assessed reliability of the information.

Creator

Choose from the list of users to filter alerts by the analyst or system that created them.

Credibility

Choose from values such as Verified, Unknown, Suspect, or more to filter alerts by the believability of the information.

Cyber Threat Type

Choose from predefined threat types such as Malware, Phishing, or more to filter alerts. For example, select Ransomware to quickly locate alerts related to ransomware activity.

Detection Method

Choose from detection methods such as AV Logs, Audit, Customer, or more to filter alerts. For example, select Employee Reports to focus on alerts raised by internal staff.

Document Type

Select a document type to narrow your search. For example, select Cyber Security Best Practices to focus on recommended security measures.

Exploit Likelihood

Filter alerts based on the assessed chance of exploitation.

Exploited Wild

Filter alerts by whether the related vulnerability is actively being used in real-world attacks.

Info Source

Choose the origin of the alert to quickly narrow down alerts from specific intelligence providers or organizations.

Kill Chain Phase

Filter alerts by the stage of the attack lifecycle, such as Reconnaissance or Command and Control, to focus on threats at specific phases.

Locations

Filter alerts based on geographical locations. You can search by country, state, city, or site to narrow down alert results.

Number of Systems Affected

Filter alerts based on the number of systems or computers affected by a threat or incident.

Organizations

Filter alerts based on the organizations associated with alert recipients.

Physical Threat Type

Filter alerts by the type of physical security threat, which may impact people, resources, or infrastructure.

Priority

Filter alerts based on their priority level. Higher numbers indicate alerts that require greater attention and faster handling.

Published Date

Filter alerts based on the date they were published. Use this to narrow results to alerts created within a specific time range.

Publisher

Filter alerts based on the entity that published them.

RFI Response

Filter alerts based on the content of RFI responses. Enter text to search for specific keywords or phrases within the response field.

Recipient Group

Filter alerts based on the recipient groups they are shared with.

Report Source

Filter alerts based on the entity that reported the information. Report sources can include a person, publication, or organization, such as a Government Agency, Law Enforcement, or Friend.

Risk

Filter alerts based on their risk value. Higher numbers indicate a greater level of risk associated with the alert.

Root Cause

Filter alerts based on the initiating cause of the threat or incident.

Severity

Filter alerts by severity to focus on threats with the desired impact, such as Informational, Minimal, Moderate, Major, or Significant.

Status

Filter alerts to display only those corresponding to a specific status. You can filter by DRAFT, SUBMITTED, PUBLISHED, SCHEDULED, EXPIRED, or REVERTED.

SubTechnique

Filter alerts to display only those associated with a specific MITRE ATT&CK sub-technique. This allows you to focus on alerts relevant to particular adversary behaviors or tactics. This filter is available only if the feature is enabled. For more information, see Configure Collaborate Features.

TLP

Filter alerts to display only those assigned a specific Traffic Light Protocol (TLP) level. Available levels include RED, AMBER+STRICT, AMBER, GREEN, and CLEAR.

Tactic

Filter alerts to display only those associated with a specific MITRE ATT&CK tactic. This helps focus on alerts related to particular adversary objectives or goals. This filter is available only if the feature is enabled. For more information, see Configure Collaborate Features.

Tags

Use this filter to display alerts associated with one or more tags. You can select multiple tags in a single query to view results that match any of the selected tags.

Targeted Sector

Filter alerts to include only those associated with specific sectors. For example, select Healthcare and Finance to focus on alerts affecting those sectors.

Technique

Filter alerts to include only those associated with specific MITRE ATT&CK techniques. This filter is available only if the feature is enabled. For more information, see Configure Collaborate Features.

Threat Actor

Filter alerts to include only those associated with specific threat actors.

Threat Indicators

Filter alerts by entering specific threat indicators. For example, enter an IP address, domain, or malware name to focus on alerts containing that indicator.

Threat Method

Filter alerts based on the method used by a threat actor.

Title

Filter alerts by entering keywords or phrases from the alert title. Use this to narrow results to alerts whose titles match your search criteria.

Urgency

Filter alerts based on their urgency level. Higher urgency values indicate that the alert requires faster attention or response.

Vendors

Filter alerts based on the vendor associated with the alert. A vendor can be a supplier, manufacturer, or member organization within your network.

Vulnerability Source

Filter alerts based on the source reporting the vulnerability. For example, select NVD, CVE, or other vulnerability intelligence sources to focus on alerts from those sources.

Vulnerability Type

Filter alerts to include only those associated with specific types of vulnerabilities.