Confidence level in logs

[chtoh82]

Hi, 

In minemeld logs from the nodes, taking AF-Ransomware node as an example,  I have 2 questions regarding the confidence, thanks!

1. does the confidence level come from the source feed?

2. can customers change this confidence level?

[lmori · Accepted solution]

Hi @chtoh82,

good questions:

1. it depends. Some feeds provide a confidence level, in that case MineMeld will map that confidence level into its internal confidence level. Most of the OSINT feeds do not, in that case MineMeld apply a default confidence level. This default confidence level is configured per-feed and you can change it by changing the prototype. AF-Ransomware seems a feed comfing from AutoFocus, in that case Autofocus itself provides the confidence level. Why do you want to change it? Did you find a False Positive? Example of feed using default confidence level: https://github.com/PaloAltoNetworks/minemeld-node-prototypes/blob/master/prototypes/dshield.yml#L36
2. Answer included in 1) 🙂

Thanks,

luigi

[chtoh82]

Hi Luigi,

Thanks for your reply!

I am not trying to change the confidence level. I am trying to see how could i managed those confidence level in Minemeld, in this case, should there be any reason to change the level, I guess I would have to change it from the modifying the protoypte.

Thanks again!