Expanded Availability of Confidence Tag?

Feedback & Support
1

ET Team member @rgonzalez includes a nice summary by @bmurphy of the confidence metadata tag in Wiki article Confidence metadata tag and its impact & meaning. I’ve been trying to incorporate this tag in the process I use to determine whether a rule would be good for our environment, but have found that not many rules carry it. Any chance this tag could be applied to more rules? My goal is to identify the categories of rules I want to alert on (among other tags), and turn on the highest-confidence rules first as I tune our rule set.

Thanks!

1 Like
2

Thanks for asking! When it comes to metadata tags we try to be more accurate than complete and when such a large number of legacy rules (tens of thousands) this can be slow going as programmatic assignment has been tricky in the past. We’ll keep at it though, and this year we’ll increase the number tags populated for both MITRE and Confidence within the back catalog of sigs!

3

Glad to hear it, @rgonzalez, thanks!

1 Like