A Tour of the ThreatStream Overview Dashboard

View a summary of recent intelligence contributed to ThreatStream. Note that this is the top-most horizontal box at the top, which spans across the entire dashboard.

• Total # of Observables: Number of observables added during the time range selected for the dashboard.
• Your Total Contribution: Number of observables added by your organization during the selected time range. Sources include imports, streams configured by your organization, or TAXII feeds.
• My Attacks: Number of observables from the selected time range that triggered alerts in your integrated destinations. You can view expanded My Attacks data on the My Recent Attacks widget.
• Total Community Contribution: Number of observables to which you have access that were contributed by other organizations.
• # of False Positives Filtered: Number of observables to which you have access that were reported as false positive.
• Last Indicator Received: Time elapsed since the most recent observable to which you have access was added to ThreatStream.

View observables added to ThreatStream by indicator type on a bar chart. Click bar chart segments to view observables on the Observables search page.

Use the top right menu to toggle between a view of All Types, Top 5 Indicator Types, and Top 10 Indicator Types.

Indicator types represented on the chart are listed in the chart key. You can click indicator types on the chart key to add or remove them from the chart. Click Deselect All to remove all indicator types from the chart, or Select All to add all indicator types from the chart key to the chart.

View statistics on observables added to ThreatStream via your organization, private feeds, and curated open source feeds. You can click the columns to view the top 10 sources in each category, as displayed below.

• Overall: Total number of observables provided by the source.
• This Period: Number of observables provided by the source during the selected time range.
• % Change: Ratio of observables provided by the source during the selected time range over the overall total.
• # of False Positives: Observables from the source that have been identified as false positive.

View investigations assigned to you or a workgroup to which you belong by status. You can filter investigations by assignee by using the Assigned to filter.

To drill into investigations of a status, click the status count. Investigations are listed on the Investigations list view screen. See Investigations List View for more information.

View open and completed investigation tasks which have been assigned to you. The To Do tab lists tasks which you have yet to complete. Completed tasks are listed on the Completed tab.

You can mark an open task as complete by checking its box on the To Do tab. When you mark a task complete, it is moved to the Completed tab.

Similarly, you can uncheck tasks on the Completed tab to reopen and move them back to the To Do tab.

You can click tasks to visit the relevant investigation.

View the 10 most recent notifications on ThreatStream activity. Notifications are displayed when:

• Import sessions created by your organization or trusted circles of which you are a member are approved. Click the activity to view the import session.
• Import sessions created by your organization are ready for review and you have the Approve Import user privilege. Click the activity to view the import session.
• Threat model entities to which your organization has access are created, published, or updated. Click the activity to view the threat model entity.
• Investigations owned by your organization or accessible via trusted circles are updated. Click the activity to view the investigation.
• Submissions are made to an organization Import or Phishing mailbox. Links to associated import sessions, Threat Bulletins, or investigations are included in the activity. Unsuccessful submissions are also displayed.

View statistics on recently triggered rules and corresponding automated actions taken by ThreatStream.

• No Actions Taken: Number of matches during the selected time period for which no actions were configured.
• Tagged With Terms: Number of matches that resulted in intelligence being tagged with configured terms.
• Added to Investigation: Number of matches resulting in intelligence being added to investigations.
• Added to Threat Model: Number of matches resulting in intelligence being added to threat model entities.

You can click any of the rule categories to view a list of triggered rules in a pop up window.

View observables that triggered alerts in integrated destinations such as ArcSight ESM, Splunk, and Security Analytics. Count shows the number of times observables have been seen in ThreatStream. Click the Observable to drill down for deeper analysis on the observable details page.

Data must be provided to ThreatStream in a My Attacks Report in order to populate the My Recent Attacks widget. See My Attacks Report for more information.

You can view My Recent Attacks data in the My Attacks widget on observable details pages. For more on My Attacks, see Viewing Matches and My Attacks.

View open tasks which have been specifically assigned to you or available for you to complete based on your user privileges. Tasks include reviewing import sessions, reviewing threat model entities, triaging investigations that are in pending state, and approving requests to join your trusted circles.

Click the task type to drill down on open tasks.

View streams feeding your threat intelligence in ThreatStream by the Confidence and Severity scores of the observables they provide.

The quantity of intelligence is represented by the size of each circle. You can hover over a stream for the name of the stream, average Confidence score, average Severity score, iTypes provided by the stream, and the number of observables provided by the stream.

View the most recently published threat model entities to which you have access on ThreatStream. Click See more threat models to view expanded results on the Threat Model List View.