Scoring Algorithms

ThreatQ scoring algorithms automatically assign and update scores for supported objects based on criteria defined by your organization. Scoring helps analysts prioritize the threat intelligence most relevant to their environment. For stops on manually setting an object's score, see the Manually Setting an Object's Score topic.

Scoring algorithms can apply to the following object types:

• Indicators
• Adversaries
• Vulnerabilities

Scoring algorithms for adversaries and vulnerabilities can only be configured using attribute-based criteria on the Attributes tab.

How Scoring Works

Scores indicate the relative priority of an object. The scoring scale ranges from -10 to 10:

• 10 represents Very High priority.
• 0 represents a neutral score and is the default for indicators.
• -10 represents Very Low priority.

A higher score increases the priority of an object.

When you configure or update a scoring algorithm, ThreatQ recalculates the scores of applicable objects. Processing may take time, so changes might not appear immediately in the Threat Library.

Scoring Criteria

The Scoring Sensitivity Configuration page provides the following criteria sorted by tabs:

Criteria	Description	Support Object Types
Indicator Tab	Assigns scores based on the indicator type.	Indicators
Indicator Source	Assigns scores based on the source of the indicator.	Indicators
Attributes	Assigns scores based on an attribute key and value associated with an object.	Adversaries, Indicators, and Vulnerabilities
Adversary Relationships	Assigns scores to indicators based on their relationships with adversaries.	Indicators

Accessing the Scoring Sensitivity Page

From the navigation menu, click Threat Library and select Scoring under the Data Controls heading. The Data Controls page opens with the Scoring tab and Indicator Type sub-tab selected.

Configure Scoring by Indicator Type

Indicator type scoring allows you to prioritize indicators based on their usefulness to your organization.

For example, if your organization cannot process or does not use Fuzzy Hash indicators, you can assign the Fuzzy Hash indicator type a lower score, such as -3.

1. Select the Indicator Type tab.
2. Locate the indicator type by scrolling through the list or filtering by name.
3. Adjust the score using one of the following methods:
   • Drag the scoring slider to the required value.
   • Click the up or down arrow next to the current score.
4. Optionally, click Calculate Impact to determine how many indicators will be affected.
5. Click Apply to save the configuration.

Configure Scoring by Indicator Source

Indicator source scoring allows you to prioritize indicators based on your confidence in the source of the data.

For example, if your organization has greater confidence in intelligence from a paid feed, you can assign indicators from that source a higher score, such as 3.

1. Select the Indicator Source tab.
2. Locate the source by scrolling through the list or filtering by source name.
3. Adjust the score using one of the following methods:
   • Drag the scoring slider to the required value.
   • Click the up or down arrow next to the current score.
4. Optionally, click Calculate Impact to determine how many indicators will be affected.
5. Click Apply to save the configuration.

Configure Scoring by Attribute

Attribute scoring assigns scores based on an attribute key and value associated with an object. It can be used for indicators, adversaries, and vulnerabilities.

You can use attributes supplied by an intelligence provider or custom attributes added by internal users. For example, if your organization applies a Department attribute to identify the team targeted by a threat, you can assign a higher score to objects with the attribute Department - Finance.

1. Select the Attributes tab.
2. Click Add.
3. Specify the attribute key using one of the following methods:
   • Open the Key dropdown and select an attribute.
   • Enter the attribute key in the Key field.
4. In the Value field, enter one of the following: o The specific attribute value to which the score applies.

   An asterisk (*) to apply the score to every value associated with the selected attribute key.

5. Adjust the score using one of the following methods:
   • Drag the scoring slider to the required value.
   • Click the up or down arrow next to the current score.
6. To configure additional attribute criteria, click Add and repeat the preceding steps.
7. Optionally, click Calculate Impact to determine how many objects will be affected.
8. Click Apply to save the configuration.
9. The new scoring criterion appears on the Attributes tab in the following format: <Key> is <Value>.

Configure Scoring by Adversary Relationship

Adversary relationship scoring allows you to prioritize indicators associated with adversaries that target your industry or organization.

The Any Adversary option applies the configured score to any indicator with a positive adversary attribution.

1. Select the Adversary Relationship tab.
2. Click Add.
3. Open the Select Adversary dropdown.
4. Locate and select an adversary using the scroll bar or search field.

   To apply the score to indicators with a positive attribution to any adversary, select Any Adversary.

5. Adjust the score using one of the following methods:
   • Drag the scoring slider to the required value.
   • Click the up or down arrow next to the current score.
6. To configure additional adversary relationship criteria, click Add and repeat the preceding steps.
7. Optionally, click Calculate Impact to determine how many indicators will be affected.
8. Click Apply to save the configuration.

Update a Scoring Algorithm

Review scoring configurations periodically to ensure that they reflect changes in your organization’s threat environment and priorities, including:

• Changes to the organization’s risk profile
• Organizational or geopolitical changes
• New adversaries
• New adversary tactics
• New tools and techniques

To update a scoring algorithm:

1. Open the appropriate tab:
   • Indicator Type
   • Indicator Source
   • Attributes
   • Adversary Relationship
2. Locate the scoring criterion that you want to update.
3. Adjust the score using one of the following methods:
   • Drag the scoring slider to the required value.
   • Click the up or down arrow next to the current score.
4. Optionally, click Calculate Impact to determine how many objects will be affected.
5. Click Apply to save the changes.

Scoring Considerations

• Use Calculate Impact before applying a change to identify how many objects the configuration will affect.
• Allow time for ThreatQ to process scoring configuration changes. Updated scores might not appear in the Threat Library immediately.
• A manually assigned object score overrides the score calculated by a scoring algorithm.
• Adversary and vulnerability scoring must be configured on the Attributes tab.
• Review scoring algorithms regularly to ensure that they continue to represent your organization’s intelligence priorities and risk profile.