Skip to content

Latest commit

 

History

History
220 lines (168 loc) · 13.7 KB

threat_intelligence.md

File metadata and controls

220 lines (168 loc) · 13.7 KB
Raw

Threat intelligence: Table of Content

Must read/watch

Books/articles/recordings

What is threat intel (service)?

As per Gartner:

The mandatory features for services in this market include:

  • Indicators of compromise (IoCs), including malicious or suspicious ratings, such as IP addresses, URLs, domains and file hashes.
  • Direct technical intelligence collection or research, enabling the consumer to tailor collection or search functionality for relevant IoCs.
  • Configuration of alerting thresholds based on predefined criteria.
  • Machine-to-machine integrations to either push or pull intelligence artifacts through to multiple solutions.
  • Out-of-the-box enrichments to IoCs, such as tentative attribution, geolocation data and registration information.
  • An interactive user portal with built-in analysis functionalities such as contextualized dashboards, configurable alerting and search features.
  • IOC scoring or risk rating as a way to illustrate confidence in maliciousness or suspiciousness.
  • Investigative support options, which may include ad hoc requests-for-information, longer-term analysis or recurring analyst augmentation.

TI / DRPS / EASM

Reminder:

  • DRPS = digital risk protection services.
    • As per Gartner:

    DRPS stretch detection and monitoring activities outside of the enterprise perimeter by searching for threats to enterprise digital resources, such as IP addresses, domains and brand-related assets. DRPS solutions provide visibility into the open (surface) web, dark web and deep web environments by providing contextual information on threat actors and the tactics and processes that they exploit to conduct malicious activities. DRPS providers support a variety of roles (such as chief information security officers, risk, compliance and legal teams, HR and marketing professionals) to map and monitor digital assets. They also support mitigating activities such as site/account takedowns and the generation of customized reporting. Takedown services can include forensics (postinvestigation and data recovery) and after-action monitoring.

  • EASM = external attack surface management
    • As per Gartner:

    EASM is an adjacent technology market that overlaps with DRPS and TI. It is a combination of technology, processes and managed services that provides visibility of known and unknown digital assets to give organizations an outside-in view of their environment [...]. This, in turn, can help organizations prioritize threat and exposure treatment activity. However, Gartner predicts that EASM capabilities will be assimilated into other security solutions (i.e., DRPS, TI, vulnerability management, exposure assessment and adversarial exposure validation) in the near future, and may no longer be a stand-alone market in the next three to five years.

As per Gartner:

image

Threat Intel DIKI Pyramid

As per Gartner, image

Threat intel life cycle

Here is an overview of a generic cyber threat intel lifecycle, with the following key steps:

  • Plannning & Direction,
  • Collection,
  • Processing & Exploitation;
  • Analysis & Production,
  • Dissemination & Integration.

image

Platform

TIP choice

Here are my recommendations:

Common TIP integrations (dataflow)

As per Forrester article, here is a drawing about examples of common integration between threat intel sources, TIP, and security solutions:

image

Architecture example

Here is an example of an architecture with:

  • SIEM: Elastic;
  • TIP: MISP / OpenCTI;
  • SIRP: TheHive;
  • Threat intel orchestrator: Cortex.

image

Sources

Threat intelligence and automation

Threat intel data collection and automation

Considering the huge number of OSINT sources you are likely to need to watch for threat intel (IOC, etc.), my recommendation is to try to automate as much as possible the manual part of this recurring process.

Thus, you may want to have a look at tools such as: Watcher. Here is a sample screenshot of it: image

Threat intel program and automation

As per ThreatConnect article:

As threat intelligence drives your orchestrated actions, the result of those actions can be used to create or enhance existing threat intelligence. Thus, a feedback loop is created — threat intelligence drives orchestration, orchestration enhances threat intelligence.

image

Identity-based detections

  • Correlate identity-related detections (from sensors like EDR, CASB, proxies, WAF, AD, ...) with identity intelligence (for instance, passwords leak/sell detection);

    • Here is an example of the global detection process (with courtesy of RecordedFuture):

    Capture9

End

Go to main page.