Maltiverse Threat Intelligence Platform introduces a versatile, powerfull and editable Scoring Algorithm designed to enhance the efficiency and accuracy of threat intelligence management for enterprise customers. This documentation outlines the functionality and configuration of the Scoring Algorithm.
Overview #
The Scoring Algorithm is a rule-based system that operates on the threat intelligence data uploaded by the customer to their instance of the Maltiverse Threat Intelligence Platform. It is engineered to provide flexibility and control, allowing users to tailor the threat assessment criteria according to their specific organizational needs.
Key Features #
- Fully Editable Rules: Users can create, modify, and delete rules as required.
- Flexible Query Construction: Each rule contains a query that targets specific Indicators of Compromise (IoCs).
- Action Stack: A series of actions are associated with each rule to be executed on the matched IoCs.
- Periodic Execution: Rules can be set to execute periodically (hourly, daily, weekly, monthly) or none for manual execution.
- Enable/Disable Selector: Users can easily enable or disable rules as needed.
Rule Components #
1. Query #
- Purpose: To select IoCs based on defined criteria.
2. Name #
- A unique identifier for the rule.
3. Description #
- A brief explanation of what the rule does.
4. Enable/Disable Selector #
- Toggle to activate or deactivate the rule.
5. Periodic Execution #
- Optional setting to automate rule execution on a schedule.
6. Action Stack #
- A set of actions to be applied to the IoCs that match the query.
Implementation #
- Creating a Rule
- Editing a rule
- Enablig/disabling a Rule
Benefits #
- Safety: Reduces false positives, ensuring that security measures do not disrupt legitimate services.
- Customization: Tailors threat intelligence processing to align with organizational policies.
- Efficiency: Automates the handling of specific types of IoCs, reducing manual workload.
- Scalability: Adaptable to evolving threat landscapes and organizational changes.
Conclusion #
The Scoring Algorithm in the Maltiverse Threat Intelligence Platform offers a significant level of control and customization to enterprise users. By leveraging this feature, organizations can efficiently manage their threat intelligence, ensuring that their cybersecurity measures are both accurate and aligned with their specific operational requirements.
