Return
-
Title
As a Threat Detection Administrator I’d like the ability to set the SMART alert threshold value -
Description
In some scenarios (testing in particular) it may be desired to lower the SMART alert threshold value so that lower scoring activity will generate alerts visible in the Threat Detection UI.
-
Cause
The default SMART alert threshold value is 75 indicating that any SMART alert scored under it will be filtered out. In testing it may be difficult to generate behavior with SMART alert scores higher than 75. -
Resolution
The attached utility allows easy manipulation of the SMART alert threshold value used for generating alerts in the Threat Detection UI. By lowering the value, lower scoring SMART alerts will be displayed in the Threat Detection UI.
Note: The specified threshold takes effect for newly generated activity only.
- Extract the utility.
- Run SMARTScoreThreshold.exe.
- Enter the TD Server FQDN, hostname, or IP address and Integration password.
- Click ‘Connect’.
- The current SMART alert (Smart Score) threshold value will be displayed.
- Set the desired SMART alert (Smart Score) threshold value.
- Click ‘Apply’
- Click ‘Reboot Server’
System Requirements:
Windows Server 2012 or higher OS with .Net 4.6.1 or higher installed. -
Attachments