Anomali ThreatStream change DBot verdict from Benign to Unknown for Low Confidence Indicators

Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.py

@@ -496,6 +496,12 @@ def __init__(self, params: Dict):
 
         }
 
+        indicator_default_score = params.get('indicator_default_score')
+        if indicator_default_score and indicator_default_score == 'Unknown':
+            self.default_score = Common.DBotScore.NONE
+        else:
+            self.default_score = Common.DBotScore.GOOD
+
     def calculate_score(self, ioc_type: str, indicator, threshold=None):
         """
             Calculate the DBot score according the indicator's confidence and thresholds if exist
@@ -506,14 +512,14 @@ def calculate_score(self, ioc_type: str, indicator, threshold=None):
         confidence = indicator.get('confidence', Common.DBotScore.NONE)
         defined_threshold = threshold or self.instance_defined_thresholds.get(ioc_type)
         if defined_threshold:
-            return Common.DBotScore.BAD if confidence >= defined_threshold else Common.DBotScore.GOOD
+            return Common.DBotScore.BAD if confidence >= defined_threshold else self.default_score
         else:
             if confidence > DEFAULT_MALICIOUS_THRESHOLD:
                 return Common.DBotScore.BAD
             if confidence > DEFAULT_SUSPICIOUS_THRESHOLD:
                 return Common.DBotScore.SUSPICIOUS
             else:
-                return Common.DBotScore.GOOD
+                return self.default_score
 
 
 def find_worst_indicator(indicators):

Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml

@@ -1,4 +1,4 @@
 category: Data Enrichment & Threat Intelligence
 sectionOrder:
 - Connect
 - Collect
@@ -72,6 +72,15 @@
   required: true
   type: 15
   section: Collect
+- defaultvalue: Benign
+  display: Default DBOT score for indicators with low Confidence
+  name: indicator_default_score
+  options:
+  - Benign
+  - Unknown
+  required: true
+  type: 15
+  section: Collect
 - defaultvalue: 'false'
   display: Trust any certificate (not secure)
   name: insecure

Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/README.md

@@ -25,6 +25,7 @@ If you are upgrading from a previous version of this integration, see [Breaking
     | Use system proxy settings |  | False |
     | Create relationships | Create relationships between indicators as part of enrichment. | False |
     | Remote API | Gather additional information about the threat model from remote APIs. | False |
+    | Default DBOT score for indicators with low Confidence |  | True |
 
 4. Click **Test** to validate the URLs, token, and connection.
 

Packs/Anomali_ThreatStream/ReleaseNotes/2_2_6.md

@@ -0,0 +1,5 @@
+
+#### Integrations
+
+##### Anomali ThreatStream v3
+- Added a new parameter **Default DBOT score for indicators with low Confidence** - toggle between `Unknown` and `Benign`.

Packs/Anomali_ThreatStream/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Anomali ThreatStream",
     "description": "Use Anomali ThreatStream to query and submit threats.",
     "support": "xsoar",
-    "currentVersion": "2.2.5",
+    "currentVersion": "2.2.6",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",