Skip to main content

Cyware Threat Intelligence eXchange

Configure External Risk Score

Configure the external sources for which the Intel Exchange Risk Score is disabled and the Risk Score provided by the external source is utilized. 

Note

Sources that are previously added in the Intel Exchange Risk Score are unavailable while configuring the External Risk Score.

Steps 

To configure the External Risk Score, follow these steps:

  1. Sign in to Intel Exchange.

  2. Go to Administration > Risk Score Engine.

  3. Click the vertical ellipsis for External Risk Score and select Edit.

  4. Click + Source.

    Note

    If CrowdStrike and Recorded Future are configured and enabled in Integration Management > Feed Sources, they are included as the sources for the External Risk Score by default. You can modify this configuration based on your preference.

  5. From the available source categories, select the sources to be considered for the final Risk Score.

  6. Click Save. Ensure that you turn on the Status toggle to enable the External Risk Score in Intel Exchange.

If an indicator is reported by multiple sources that are part of the External Risk Score, the source confidence of the source with the most recent Source Modified Date is retained as the Risk Score.