Threat Intelligence Data Quality Dashboard

Section 1 — STIX Data Overview The top section gives users a high-level snapshot of the platform's STIX data footprint. It displays count widgets for the three core STIX object categories — STIX Domain Objects (SDO), STIX Cyber Observables (SCO), and STIX Relationship Objects (SRO) — alongside horizontal bar charts showing the top 10 most prevalent types in each category. Donut charts then break down the top 10 creators for each object type, making it easy to understand who or what (users, connectors, feeds) is producing the most data.

Section 2 — Orphan STIX Entities This section focuses on data quality hygiene by surfacing objects that exist in isolation — i.e., not connected to any other object via a relationship. It provides count widgets and vertical bar charts (by month) for both orphan SDOs and orphan SCOs, letting analysts track whether the volume of disconnected objects is growing or shrinking over time. Distribution lists and horizontal bar charts further break down which entity types and which creators are responsible for generating these orphans. A list widget specifically highlights orphan entities created in the last 7 days, acting as a near-real-time alert for newly ingested but unlinked data. A line chart shows the orphan creation trend over time (by week), useful for spotting spikes tied to specific feed ingestion events.

Section 3 — Threat Intelligence Feed Quality The final section evaluates the quality and utility of threat intelligence feeds. It includes widgets tracking Unique Indicators per Feed (filtered by a specific label), Shared Indicators per Feed (indicators appearing across multiple feeds), and key IoC health metrics: Unique IoCs, Detected IoCs (flagged for detection), Malicious IoCs (labelled as malicious), Active IoCs (not revoked), and Stale IoCs (revoked). Together these widgets let analysts assess feed overlap, freshness, and operational relevance at a glance.

Section 3 of this dashboard, requires these playbooks to be setup on your system Label Indicators Unique and Shared and Remove Unique Label — Shared Indicator Cleanup