We are pleased to announce the release of version 2.4.0 of the GSE platform. Full release notes for this release can be found here. This release has the following key features
Enhanced Group Impact Metrics
New exciting metrics designed to give group administrators and analysts a quick insight into the performance of the group, reflecting activity that makes a real impact in the fight against scams and fraud.
Building on the introduction of impact measures over the last few months, this release introduces a completely redesigned group dashboard with the following key impact metrics.
- Group performance as assessed by the average GSE index for the group
- Uplift and overlap as an overall percentage for the group. Uplift - new signal intelligence typically appearing in a single threat feed and visible to the GSE for the first time. Overlap - appearing in more than one threat feed.
- Feedback metrics based upon amount of feedback received both as a result of automation on the GSE and from our users.
- An optional Impact Value measured in $ based on a nominal cost per signal (this is configured by the GSE on request)
In addition, the average GSE Index and total Net New signals can be seen individually per source feed in the new Group Activity section and the Latest Activity table has been enhanced to show more information per signal for the latest reports received within the group. This includes the latest calculated value for the GSE index as well as enrichment data for the signal where available.
Improved Single Sign-on (SSO) Support (added SAML)
Enabling GSE Platform users to seamlessly access the platform using their own organisation’s authentication technology.
Following the successful launch of Open ID support last month we are delighted to be augmenting our single sign on support with support for SAML. As with Open ID this can be customised via account settings in the dashboard to allow access to organisation specific SAML servers.
Expanded Query Functionality
Querying language and tools, enabling GSE power users to tailor GSE results to filter, limit and refine the output.
To further enhance the query potential on the platform for our users we have expanded the scope of the Query Signals function to provide access to all of the datasets available through our API functionality. This will provide more powerful querying options on the platform to support interactive use and export via CSV which we hope will prove useful to many of our users.
ASN League Table
An ASN (Autonomous System Number) is a unique identifier for a large group of IP addresses managed by a single organization (like an ISP, a university, or a cloud provider). Think of the internet as a collection of thousands of individual "neighborhoods"—the ASN is the ID for an entire neighborhood.
The ASN League Table organises these neighborhoods based on the volume of verified threat signals they generate:
- The Top of the Table: Contains ASNs attracting the fewest threat reports. These networks have a lower density of reported malicious activity (like phishing or malware hosting) relative to their size.
- The Bottom of the Table: Contains ASNs attracting the most threat reports. This indicates a higher concentration of reported threats originating from or hosted within that specific network's infrastructure.
The ASN league table considers the report rates detected per Autonomous System using Enrichment data gathered by the GSE for signals which can be resolved to IP addresses - this includes signals which contain IP addresses directly as well as domain name based signals which resolve to ip addresses for e.g. access to websites.
As with our existing league tables we measure the report rate as a ratio of the number of distinct IP addresses found in reports referring to a given AS relative to the total number of IP addresses allocated to the AS. This provides a weighted score from which a league table ranking can be generated.
The ASN league table is being released just for GSE users privately within the dashboard at this stage and we will be looking to make this publicly available following feedback from our users.
Coming Soon
We are very excited to be developing new AI capabilities (branded as GSE Compass) within the GSE platform. This will provide users with a chat type interface for querying signals based on a number of attributes gathered in our enrichment process. We believe this will unlock a lot more potential for the platform to be used as an investigative tool and are looking forward to this developing and being rolled out over the coming months.
