What is a Threat Intelligence Platform?
A Threat Intelligence Platform (abbreviated as TIP) allows workers throughout the venture to manage operations on the security relevant data that they value. Other personnel functions can be included in addition same data together within the same or a new process. Operations might include triaging occurrences in the SOC, performing incident response, or the danger team's procedures for integrating exterior feeds or intellect.
Through the management point of view, the system must present movements, supply real-time improvements, as well as support threat-driven long-term prioritization over the business. The system must support the integration of all stakeholders and data that is pertinent to each in ways where they could work along as a team. Customization of the program is key, as each corporation will have different operations, and data customizations needs across operations for aggregation, research, and action.
Aggregation - From Feeds to Intelligence
The culmination of 1 or even more feeds is not sufficient alone; instead you will need to give attention to control your own data then overlay what everybody else knows in addition. Without this kind of understanding you never really know what is truly highly relevant to your organization.
There's a lot of focus on feeds available on the market right now. Just how many feeds do you really support and those? Is it possible to support organized and unstructured data source? Will you support STIX? What's the procedure (manual, computerized, semi-automated) to obtain it in to the system? Does one support API level integrations? Although these exact things are important, I'd attest these questions are just the start, and the simple area of the question.
Instead, we have to be considering bigger and considering how inbound feeds will be produced relevant and exactly how they'll support the many procedures and stakeholders throughout the business enterprise that use them in several ways. Incoming supply data must be correlated with the organization's hazard repository, and designed to meet up with the needs of the several stakeholders - from security team employees to management and beyond. Automation of handling feeds will be critical to enable you to avoid frustrating your personnel with mundane data handling. Despite having automation, you'll need to support human being processing on supply data to ensure its effectiveness. This will demand examination process support as defined below.
Finally, the responses loop will be critical to be able to aid the procedures of assessing the feeds you are employing. This allows internal happenings to identify what feed options are most relevant to the business, and what forms of data hold the most usefulness.
Analysis - Where in fact the Rubber meets the street
Examination is a key feature of the Threat Intelligence Platform and it requires automating as a lot of the handling as is theoretically possible. This involves the system to be constructed with data management at heart and automation cannot be an afterthought.
Conclusion
For risk data to be threat intelligence it should be relevant. In the world of network defense, this means it must be highly relevant to the threats that your organization faces. For this reason it does not make sense to split up event response and threat evaluation processes or clubs into separate program environments. Doing this would be needlessly segmenting interior intellect gleaned from incident response and external intelligence from research and indicator feeds. By tugging all of your stakeholders and data into an individual enterprise security program you may make everyone more productive, make smarter decisions, and start to automate the operations of detecting and responding to cyber threats in a far more comprehensive way.
