Observables

Gauges the potential impact of the indicator type the observable is thought to be associated with.

By default, ThreatStream maps observables to one of four severity values based on the indicator type with which they are associated. For example, command and control indicator types are mapped to the severity value High, while TOR related observables are mapped to Low. However, cases occur in which default values are not displayed. In some cases, severity values assigned to observables by the source are used. Additionally, severity values can be modified by ThreatStream users when editing observables that belong to their organizations.

For a complete list of indicator types and corresponding default severity values, see Indicator Types in ThreatStream.

Confidence indicates the certainty that an observable exhibits or is connected to malicious behavior. Anomali ThreatStream's machine learning-based threat intelligence engine calculates confidence by taking many factors into account. Confidence is calculated for all available instances of a single observable as reported by various threat intelligence sources. ThreatStream's machine learning algorithms do not calculate confidence scores for email, hash, or string observable types and in cases where users select "Override System Confidence" during import or stream creation.

If the observable details page aggregates multiple instances of the same observable, the highest ThreatStream assigned confidence score of the available instances in active state is displayed. In these cases high (Hi), low (Lo), and an average (Avg) confidence values are displayed when you mouse over the confidence value.

For more information on how confidence is calculated and used in ThreatStream, see Observable Confidence in ThreatStream.

Org Admins can configure observable details pages to display the Source Reported Confidence instead of confidence values assigned by ThreatStream. For more on confidence value display settings, see Viewing and Editing Organization Settings.

Whether the observable is Active, Inactive, or False Positive.

Observables imported through feeds to which ThreatStream assigns a confidence score less than or equal to 15 are automatically marked false positive. Observables imported and approved through the ThreatStream user interface are never automatically marked false positive by ThreatStream. Since an observable can have multiple instances, cases occur in which observable values—imported through a feed—are automatically marked false positive by ThreatStream due to their confidence scores, while identical values—imported and approved through the ThreatStream user interface—have active status.

Indicator type associated with the observable. See Indicator Types in ThreatStream for more information.

If the observable details page aggregates multiple instances of the same observable, the indicator type associated with the most recently imported observable is displayed.

View tags associated with all available instances of the observable.

Click Edit to add or remove tags. Click Done to save changes.

As you type the first few characters of the tag, the 20 most used tags in your organization from the previous seven days are displayed. Enable the Preferred Tags Only toggle to display and search though only the list of preferred tags. Alternatively, enter * to display preferred tags. For more information on configuring Preferred Tags, see Adding Preferred Tags to Intelligence.

Tags must be 2,000 characters or less. Observables can contain up to 200 tags per organization. Tags added by other organizations do not count toward this limit.

To add private tags that are only visible to your organization, assign them the My Organization visibility setting. Tags assigned the Anomali Community visibility setting are visible to any user with access to the observable. See Adding Private Tags to Observables for more information. Since organizations can decide whether users outside of their organization can add public tags to their data, the Anomali Community visibility setting is not available in all cases. In cases where there are multiple instances of an observable, Anomali Community tags will only be added to instances of the observable if owner organizations allow public tags from external users.

You can only remove tags that were added by users in your organization.

Source locations. ThreatStream supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

Users of the organization that owns the observable can add or delete source locations.

To add a new source location associated with the observable:

1. Click Edit.

2. Select a location.

3. Click Done.

   The source location is added to the observable.

To remove a source location from the observable:

1. Click Edit.

2. Click the "x" sign next to the location that you want to remove.

3. Click Done.

   The source location is removed from the observable.

Target Locations. ThreatStream supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

Users of the organization that owns the observable can add or delete target locations.

To add a new target location associated with the observable:

1. Click Edit.

2. Select a location.

3. Click Done.

   The target location is added to the observable.

To remove a target location from the observable:

1. Click Edit.

2. Click the "x" sign next to the location that you want to remove.

3. Click Done.

   The target location is removed from the observable.

Target industry associated with the observable. Target Industry values are defined by the STIX 2.1 Industry Sector vocabulary.

To add a new target industry:

1. Click Edit

2. Select a target industry.

3. Click Done.

   The new target industry is added to the observable.

To remove a target industry:

1. Click Edit.

2. Click the "x" sign next to the target industry that you want to remove.

3. Click Done.

   The target industry is removed form the observable.

Date the instance of the observable became active in ThreatStream.

Date the instance of the observable was most recently edited.

Click View details to view a log of changes made to the instance. Recorded changes include edits to observable confidence, expiration date, indicator type, tags, severity, status, and TLP.

Indicator type associated with the observable. See Indicator Types in ThreatStream for more information.

TLP (Traffic Light Protocol) color assigned to the instance.

The TLP color provides a mechanism to communicate to consumers of the information whether further dissemination of this information is allowed; if yes, how freely can this information be distributed.

To learn more about TLP, search for "Traffic Light Protocol" in your favorite search engine.

Confidence value assigned to an observable by its source. As data originates from an array of sources, Source Reported Confidence values can be assigned by premium feed providers, open source feeds, or individual analysts manually importing data - among others. ThreatStream ingests Source Reported Confidence scores and displays them to users as-is, without alteration. See Source Reported Confidence for more information.

Link to the import job associated with the instance.