At LookingGlass Cyber we want to make sure you get answers to important product questions so you can use scoutPRIME as efficiently and effectively as possible.

Below are frequently asked questions from customers about scoutPRIME features and functionalities. We hope that this information can help you accomplish your security goals and mission.

Feel free to also submit your questions at, [email protected].

A. The Threat Indicator Confidence (TIC) Score is a comprehensive, multi-dimensional score that measures the likelihood that a network element has been compromised, is vulnerable to compromise, or is a likely target for future compromise. The algorithm for TIC factors network proximity, multi-source corroboration, impact of compromise, and time of observed compromise.

This powerful algorithm by design brings together multiple dimensions of analysis into a single score from 00-100. Factors include:
​

· Trustworthiness of the intelligence source

· Risk and presence of compromise

· Impact of compromise

· Class of compromise

· Network relationship to compromise

· Corroboration of observation

· Volume of compromises

· Time since observed compromise

Using the TIC score, and any associated intelligence that goes with it, can help you better analyze risk.

scoutPRIME provides a TIC Score for:

A. Each network element, collection, threat, and vulnerability is assigned a system-generated TIC score. Scores are calculated differently for each (refer to the table below).

A. TIC scores can increase if new observed threat data associated with elements, threats, and vulnerabilities from our many sources is ingested by the system. scoutPRIME will use a sophisticated algorithm to sum up the risk into a single number value.

After two weeks, if associations are deemed inactive they become Historical. This will change the TIC score, otherwise the the score will remain constant.
​

A. The system assigns scores ranging from 1-100 that categorizes the current threat risks associated with various system elements. Higher numeric values indicate a greater threat potential.

Assigning a Score of Zero

When a score of zero is assigned to a threat, this tells the system not to include this in the calculations or the composite score. To get the system to ignore a threat, set the Criticality property score to zero, and the threat is no longer able to apply influence to any elements automatically.

A. The default TIC score is 10. Scores greater than 10 indicate increasing levels of risk.

Scores below 10 indicate positive assertions of risk reduction due to mitigation actions taken. There are currently no data sources providing a TIC score less than 10.

A score of 10 also means that the system hasn't registered anything necessarily positive or negative about the element, collection, etc.

A. scoutPRIME has historical and active threats. If you go to a specific element you can view historical threats for that element. Searching works for active threats, but you can include historical details using the API.

For more on this, click here.

A. The default set of time is six months.

Q. Which data objects are available in scoutPRIME?

A. scoutPRIME's rich data, includes the following types of objects/digital assets and elements:

A. We collect a vast set of propriety, commercial, and open source data sets on a continuous basis. While each data set is unique, the underlying data will typically update within a day.

A. The volume and set of metadata is massive. Here’s a sampling of common metadata:

A. Comma-separated values (CSV) and JSON. You can also create reports which generates PDF files.

A. scoutPRIME data can be transformed into STIX v1.x, v2.x, or MITRE ATT&CK. If you are interested, please reach out to our customer services team at

[email protected]

A. Currently, LookingGlass is exploring making data available through a TAXII server to customers. For more information about this please contact,

[email protected]

A. A collection is a set of elements that defines the attack surface of an organization, entity, or system, along with any additional information that may be available.

The elements that may be included in a collection include:

For more about Collections, click here.

You may also find our Key Terms article useful, click here.

A. You can build an "empty" collection (without doing a search first), or you can build a collection from search results. You can also create nested collections (children collections).

For a complete workflow on how to build an empty collection, click here.

For a complete workflow on how to build a collection from search results, click here.

A. Nested collections are "children collections" belonging to a "parent" or main collection and can be very useful for organizing or categorizing your data into sub groups. You can nest up to three children collections.

In addition, parent collections with children have a more accurate TIC score. This is because scores "aggregate up" in a collection, meaning that the scores of children collections help derive the score of the parent collection.

For a workflow on how to create nested collections, click here.

A. The recommended best practices are:

A. Some techniques for ensuring you have a complete collection include:

A. You can do many types of powerful searches in scoutPRIME and get back lots of enriched data.

Below are descriptions of what each of the four filters in the Search bar's drop-down menu can help you find:

To learn more about using scoutPRIME's search features, click here.

A. The scoutPRIME User Documentation provides you with several common workflows that you guide on how to perform many important tasks.

One of the most common workflows on scoutPRIME is on how to create a collection - click here to learn more.

Another workflow is on how to create notifications or alerts for your collections - click here to learn more.

If you are looking for a workflow on how to conduct a search, you can find it here.

You can browse through the user documentation for more workflows and other helpful steps to maximize your use of scoutPRIME's powerful features.

A. scoutPRIME is widely used by customers to monitor the digital assets of their organization and/or vendors in their supply chain.

The platform's enriched data can inform analysts about potential cyber hazards and threats and vulnerabilities that their or another organization's digital assets could be facing.

scoutPRIME's TIC score also provides insight into the growing or decreasing risk of collected digital assets. This allows analysts to take action and mitigate risk, including third-party risk.

A. You can use scoutPRIME to monitor the digital assets of any entity, including companies that do business with you such as cloud service and Internet service providers.

Please note that the platform conducts only passive scanning of digital assets, therefore the data you receive from entities is already in the public domain.

A. Networks are associated to owners through the ASN registration.

A. Users need to feel comfortable writing queries and making HTTP requests, therefore technical knowledge is needed.

A. Yes, you can generate many types of reports on scoutPRIME. For more details, refer to this article.

A. Yes, you are able to run custom reports for:

Collection Health Summary

And, for Threat Association Daily Activity.

For more details, click here.

A. Yes, scoutPRIME has a Dashboard that provides you with snapshots of your workspace collections with recent TIC scores and the latest associations (threats and vulnerabilities), etc.

Recent information you will find on the Dashboard, includes:

For more on this, see the article for The Dashboard.

A. First, do a query or search for the element/network asset using the Associated Risks filter.

The results page will list any risks for the network element you entered in your search.

You can narrow down your search results by using the Risk filter on the left panel of the page. Choose Vulnerability.

Finally, with the filter applied, scoutPRIME will load only vulnerabilities (if any) on the results page.

These are the CVE/vulnerabilities associated with the network asset.

A. When you click on a CVE/vulnerability listed on a search results page, its details will display on the Element Details section. To determine if at least one of the elements of the vulnerability (shown on the left side bar) is in any of your collections, click on Associated Collections.

If the at least one element (left side bar) associated with the CVE/vulnerability is in a collection you built, the system will list it under the Associated Collections section of the page.

A. There are “keywords” in the indicators and within the enrichment fields that LookingGlass adds to the data sources scoutPRIME is aggregating and correlating.

These keywords indicate to the user which indicators, and their related IoCs, are “attacker infrastructure” vs. “victim/infected infrastructure.” By leveraging these pieces of information, the scoutPRIME user can discern which indicators and IoCs should be used for network log correlation or deployment to a firewall vs. which indicators and IoCs should be used for incident response, vulnerability management/patching, or target/victim notification.

A. To extract all indicators or elements from a collection, follow these steps:

Associations will be downloaded to your system as a CSV file.

A. You can create collections with network elements that you import from your workstation. Once the data is ingested, you can monitor the elements. In addition, scoutPRIME provides TIC scores for the collection and what you've added to it.

To add your own data to a collection, follow these steps:

1. Create a new collection by clicking the plus sign on the top left side of the Collections panel.

2. Give your collection a Name, Description, Assign users (optional), then click Add.

3. Next, near the top of the collection name, click Rules.

4. On the Rules page, click Actions, then select Import from the drop-down menu.

5. In the dialog box, click Select CSV to begin the importing process.

IMPORTANT: Your CSV file must have a header row with: element type ("Element Type") and the element name ("Element Name"). The items should be separated by commas.

Sample formatting:

Element Type, Element Name

asn,39981

cidrv4,10.1.0.0/24

fqdn,www.google.com

ipv4,172.16.254.1

6. After selecting the CSV file, the dialog box will display your data under the Element Type and Element Name columns. Click Save to finish importing.

A. Our support team can provide you with scripts you can utilize to integrate the scoutPRIME API with third-party platforms, such as Splunk, Sentinel, etc. For more information, send an email to: [email protected].

A. You can export elements or rules (e.g., DNS records, IP addresses, etc.) as well as associations (threats and vulnerabilities) whenever you see the option to Export on a page. See example below. When you choose to export data, it will typically be in CSV or PDF format.
​

For a workflow on how to export element details, click here.