Skip to main content

Cyware Threat Intelligence eXchange

Configure External Risk Score

Configure the external sources for which the Intel Exchange Risk Score is disabled and the Risk Score provided by the external source is utilized. 

Note

Sources that are previously added in the Intel Exchange Risk Score are unavailable while configuring the External Risk Score.

Steps

To configure the External Risk Score, follow these steps:

  1. Sign in to Intel Exchange.

  2. Go to Administration > Risk Score Engine.

  3. Click the vertical ellipsis for External Risk Score and select Edit.

  4. Click + Source.

    Note

    If CrowdStrike and Recorded Future are configured and enabled in Integration Management > Feed Sources, they are included as the sources for the External Risk Score by default. You can modify this configuration based on your preference.

  5. From the available source categories, select the sources to be considered for the final Risk Score.

  6. Click Save. Ensure that you turn on the Status toggle to enable the External Risk Score in Intel Exchange.

Note

If an indicator is reported by multiple sources from either the External Risk Score or Intel Exchange Risk Score, External Risk Score sources take precedence. The Risk Score uses the source confidence from the most recently modified source in the External Risk Score.