About the GSE Platform

What are signals?

Signals are indications of malicious activity. The GSE receives signals from a range of open source and commercial providers and allows users of the platform rapid access to view and export these signals for the purpose of taking action against a range of threats.

What is the time to live (TTL)?

The time to live of a signal as measured in the GSE, is the duration between the signal being received into the GSE platform and a detected mitigation where such detection is possible (currently applicable to domain name based signals).

How do I activate new feeds on my account?

Currently there are a wide range of feeds, which have been generally available to all members of the GSE (subject to approval and a plan). Additional commercial data is also available through our Marketplace via reseller agreements (extra charges may apply).

Do I have to pay extra for feeds when I already have a subscription?

No. There are a number of generally available feeds which are included in every plan based subscription. Extra fees apply for commercial data feeds.

Why are reports called signals?

The GSE is committed to rapid exchange of threat intelligence. As such, some of our data is predictive and/or not derived from confirmed reports, as these are often extremely valuable for crime fighting. The word signal captures this hybridity more succinctly than the word report which communicates more certainty. Signals are designed to be lightweight comprising at a minimum some sort of identifier, a report date and an abuse type. This allows us to maintain a wide range of differing signal types in a cohesive way

How can I share my threat intelligence with others?

The GSE supports the sharing of your threat intelligence in three different ways:

1 - Your threat intelligence can be shared openly as signals with all users of the GSE for the greater good.

2 - Your threat intelligence can be resold as signals through our market place, generating revenue for you/your company.

3 - Your threat intelligence can be shared privately with individual users of the platform. In this case the format of the data shared is up to you and the data will not be made available to general GSE users.

Do my threat signals get shared with everybody?

It’s ultimately up to you to decide whether you wish to share your signals with the General GSE community or more privately with individuals on the platform.

Can I use the GSE to receive private data from others?

Yes. Other users can choose to share their private data with you on the GSE platform.

What are feedback reports?

Feedback reports allow users of the GSE to provide quality judgments on individual signals made available to them. Feedback reports can be used to report mitigation actions completed by the user, or to provide a score for the fidelity of the signal (e.g. was it a false positive, was it a very accurate signal?). Feedback reports are used to inform our league tables as well as ultimately to provide a quality score for signal providers.

Can I invite others to my account?

Yes, the primary GSE account holder can invite other users to join their account. Subject to plan limits.