Sources and source health
SPECTER's threat catalogue is built from reviewed intelligence sources. This page shows you how to see which sources there are, what their licensing terms allow, and when each source was last brought up to date.
Who can do this
Everyone with access to SPECTER can open Sources and Source health. An Admin also sees two diagnostic columns on Source health. You can't add, remove or switch sources on or off from the console; Soveryne manages the sources and keeps the catalogue up to date.
About the sources
Every source has been reviewed before it can be used. Examples are MITRE ATT&CK, the MISP Galaxy clusters, an index of published threat reports, and the research feeds of well-known security vendors.
Each source has a licence class:
When you reuse information from SPECTER outside Soveryne, for example in a report, follow the terms in the source's Redistribution field.
View the sources
MITRE.The table lists every reviewed source, whether it is switched on or not, with these columns:
| Column | What it shows |
|---|---|
| Name | The name of the source, for example "MITRE ATT&CK Enterprise STIX 2.1" |
| Authority Class | What kind of publisher the source is |
| Enabled | Whether the source is switched on and feeds the catalogue |
| License Class | public or restricted (see above) |
| Redistribution | What the source's terms allow, for example "attribution-required; retain ATT&CK ids and source attribution" |
Open a source
The record of an Intelligence source shows two summary figures, Enabled and Authority, and these sections:
Source health
Source health shows when each source was last brought up to date. Each row is one source, identified by a short source identifier in the Source Id column.
mitre.The columns are:
| Column | What it shows | Who sees it |
|---|---|---|
| Source Id | The short identifier of the source | Everyone |
| State | The state of the source (see below) | Everyone |
| Last Attempt At | When SPECTER last tried to update the source | Admin only |
| Last Success At | When the source was last updated successfully | Everyone |
| Error Code | Why the last update failed, if it did | Admin only |
The State is one of:
| State | Meaning |
|---|---|
| NEVER_SYNCED | The source has not been loaded yet. |
| SYNCING | The source is being updated now. |
| HEALTHY | The last update succeeded. |
| ERROR | The last update failed. |
The Source health record shows the State as its summary figure, an Ingestion section with the times of the last attempt and the last success, and, for an Admin, a Diagnostics section with the Error Code.
Troubleshooting
| Message | What it means | What to do |
|---|---|---|
| "No ingestion health has been recorded for this source." | SPECTER has no health record for this source yet, for example because it has never been loaded. | Nothing. Check Enabled on the source's record to see whether it is switched on. |
| "Records could not be loaded" | The page could not fetch its records. | Choose Refresh. If it keeps happening, contact your Soveryne partner or support. |
| A source shows ERROR for a long time | The source could not be updated. | Tell your Soveryne partner or support if you rely on that source. |