05-25-2025 06:39 AM
Hi Team,
On what basis this Reliability level is classified on Cortex XDR
Thank you
05-27-2025 02:27 AM
Hello @B.RUATTA723613 ,
This is something which you need to define. You may consider below:
An Indicator (like an IP address, file hash, domain, URL, or registry key) is assigned a reliability level based on factors such as:
Source of the Indicator:
Is it from a well-known, trusted threat intelligence provider? Or is it from an unverified source?
Verification Method:
Has the indicator been observed in multiple confirmed attacks, or is it just a one-time suspicion?
Recency and Frequency:
How recently was this indicator active, and how often does it appear in malicious contexts?
False Positive Rate:
Has this indicator been proven to cause false positives (i.e., appears in benign situations)?
Contextual Information:
Is the indicator tied to known malware campaigns, threat actor groups, or attack techniques?
If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.
05-27-2025 02:27 AM
Hello @B.RUATTA723613 ,
This is something which you need to define. You may consider below:
An Indicator (like an IP address, file hash, domain, URL, or registry key) is assigned a reliability level based on factors such as:
Source of the Indicator:
Is it from a well-known, trusted threat intelligence provider? Or is it from an unverified source?
Verification Method:
Has the indicator been observed in multiple confirmed attacks, or is it just a one-time suspicion?
Recency and Frequency:
How recently was this indicator active, and how often does it appear in malicious contexts?
False Positive Rate:
Has this indicator been proven to cause false positives (i.e., appears in benign situations)?
Contextual Information:
Is the indicator tied to known malware campaigns, threat actor groups, or attack techniques?
If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
