topic Re: Confidence level in logs in General Topics

Confidence level in logs

chtoh82 — Fri, 29 Jun 2018 03:41:29 GMT

Hi,

In minemeld logs from the nodes, taking AF-Ransomware node as an example, I have 2 questions regarding the confidence, thanks!

1. does the confidence level come from the source feed?

2. can customers change this confidence level?

Re: Confidence level in logs

lmori — Fri, 29 Jun 2018 12:16:44 GMT

Hi @chtoh82,

good questions:

it depends. Some feeds provide a confidence level, in that case MineMeld will map that confidence level into its internal confidence level. Most of the OSINT feeds do not, in that case MineMeld apply a default confidence level. This default confidence level is configured per-feed and you can change it by changing the prototype. AF-Ransomware seems a feed comfing from AutoFocus, in that case Autofocus itself provides the confidence level. Why do you want to change it? Did you find a False Positive? Example of feed using default confidence level: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml#L36
Answer included in 1) 🙂

Thanks,

luigi

Re: Confidence level in logs

chtoh82 — Mon, 02 Jul 2018 06:10:11 GMT

Hi Luigi,

Thanks for your reply!

I am not trying to change the confidence level. I am trying to see how could i managed those confidence level in Minemeld, in this case, should there be any reason to change the level, I guess I would have to change it from the modifying the protoypte.

Thanks again!