Cyware Threat Intelligence eXchange

Source sightings indicate the unique number of times the indicators are seen in the platform and from different threat feed providers. If the indicator is seen more often, this score is higher. If the indicator is seen less often, this score is lower.

Source Sightings Score

Source sightings score is a number between 10-75 based on the number of unique sightings.

For example, if multiple sources report a particular indicator, then its source sightings score may be as high as 75 indicating a higher probability of it being malicious.

Relations in CTIX represent the STIX relationships between objects, linking multiple indicators and describing their interconnections. These relationships play a vital role in assessing the malicious nature of the indicators, and CTIX employs a relation score to facilitate this determination.

Relations Score

The Relations Score is calculated by considering the diverse relations that an indicator can have with other threat data objects, such as malware, campaign, threat actor, vulnerability, and others. The score varies depending on the specific relation. Additionally, when an indicator is associated with a report object, the calculation of the relation score also considers the secondary relation between the indicator and the objects within the report. This scoring system aids in effectively determining the significance of the relationships and their potential impact on the platform's threat intelligence analysis.

For example, if an analyst evaluates two indicators associated with malware and a campaign, and assigns a higher analyst score to the malware-related indicator compared to the campaign-related one, the platform incorporates this analyst assessment. Consequently, when the platform computes the relations score for these indicators, it assigns a higher score to the malware-related indicator, reflecting the analyst's prioritization based on their investigations.

This scoring system assists in evaluating the significance and potential impact of the relationships between indicators and other threat data objects in the platform.

CTIX enriches the threat data by removing false positives, deduplication, and adding contextual information. CTIX integrates with many third-party enrichment tools that provide invaluable data to enrich these indicators. This is a configurable parameter. You can configure an enrichment policy and define what you want to enrich using which tools. This data is then used to enhance the scoring system to provide an effective confidence score. The enrichment policy is configured for IP, URL, hash, and domain.

For information about configuring an enrichment policy, see Configure Enrichment Policy.

Enrichment Policy Score

The enrichment policy score is calculated based on the data received from the enrichment feed sources and a normalized value is assigned.

An indicator that is enriched within 'x' number of days will not be re-enriched. You can configure 'x' from Administration > Configuration > Enrich a previously enriched IOC again after and has a default value of seven days. Use this option to conserve the quota of your enrichment tools and prevent immediate duplicate enrichment.

For IP, Domain, Hash, and URL, the time range that the enrichment values received affects the normalized score. If the value is received in 1-2 months, the enrichment is the latest, hence the score is higher. If the received enrichment feeds are older, the score is lower.

For IP, domain, and URL, the score is decreased if the feeds are older than 6 months. The older the feeds, the more relevance reduces and the score is further reduced.

CTIX receives threat feeds from many sources. These sources can be APIs, RSS feeds, STIX sources, email, and more. The trustworthiness of these sources is an important factor to determine the confidence level of the indicators. This is a configurable parameter. Using the new Confidence Score Engine, you can specify a value to indicate the trustworthiness of all your threat feed collection sources. This value is ultimately used to calculate the confidence score.

Source Confidence Score

The weighted source confidence is calculated based on the source weightage that you provide for all your feed sources. See Configure Source Scoring.

This source weightage is then multiplied with a normalized value that CTIX determines using standard business high and business low average values for all feed providers to arrive at a Source Confidence Score.