18 lines
1.3 KiB
Plaintext
18 lines
1.3 KiB
Plaintext
=== Expressing confidence in an analysis
|
|
|
|
NOTE: Expressing the confidence or the lack of in an analysis is critical step to help a partner or a third-party to check your hypotheses and conclusions.
|
|
|
|
Analysis or reports are often shared with technical details but often lack the overall confidence level associated.
|
|
|
|
Adding confidence or estimative probability have multiple advantages such as:
|
|
|
|
- Allowing receiving organisations to filter, classify and score the information in an automated way
|
|
- Information with low-confidence can still be shared and reach communities or organisations interested in such information without impacting organisations filtering out by confidence level
|
|
- Supporting counter and competitive analyses to validate hypotheses expressed in original reporting
|
|
|
|
Complement analysis with contrary evidences is also very welcome to ensure the original analysis and the hypotheses evaluated.
|
|
|
|
TIP: MISP taxonomies contain an exhaustive list of confidence levels including words of https://www.misp-project.org/taxonomies.html#_estimative_language[estimative probability] or confidence in analytic judgment.
|
|
|
|
TIP: threat-intelligence.eu includes an overview of the https://www.threat-intelligence.eu/methodologies/[methodologies and process to support threat intelligence].
|