Small Cyber Threat Intelligence Program
This is my journey to build a small Threat Intelligence Program
Last updated
Was this helpful?
This is my journey to build a small Threat Intelligence Program
Last updated
Was this helpful?
When I studied and learned about CTI there was a cycle that at first I overlooked but now I realize it is very crucial to understand this cycle, which is the CTI Life Cycle
The first thing in CTI is to have a requirement
You try to answer a question from your employer, your C-level, or for yourself. Such questions could be vague and broad for example:
Is our company likely to be a target for a ransomware attack?
What adversaries might attack our company?
To be sure that the most relevant and most critical information is processed and not lost into the noise.
This can enable SOC, C-level, and customer to create an intelligence requirement request such as:
Trend Reports
Threat Profile
Cyber Threat Advisory
...
After you have your requirement you now need to collect the data and all the telemetry, the historical and related data to the requirement.
The second step of TI is to collect data, the first step is the direction (which is not the purpose of this guide). There are 3 types of information sources:
Internal Source (network traffic, logs, scans)
Technical Source (Vul DB, Threat Feeds, OSINT) → free feed or paid free, or could be malware repository or C2 scanner
Human Source (Dark Web, Social Media, Forums, Cyber Security Blogs, and Feeds) → It is very hard and needs a dedicated person and training to penetrate and collect data
MISP Community Feed OSINT
MISP Commnunity Feed
CISA Known Exploited CVE
A
A
CISA ICS/OT Adversory
A
A
ICS Stuffs
AlienVault Open Threat Exchange (Need to creat acount and obtain API key)
Threat Fox
Ransomwatch
B
B
Ransomware Live
APT Group and Operation
B
B
Botvrj
AlienVault OTX
Abuse CH
Emerging Threats
Malpulse
Unpac me
Tools could be used to generate/find data
I read the Cuckoo's Egg and really love it, on how Cliff actually know every part of his network, I think he did a good job on Assets Management.
This will need some standardization the gather asset information
For me, I just use this spreadsheet as a template for Assets Management (IP addresses, what is its function, how critical it is)
<Insert the spreadsheet>
(you can use API to crawl this data)
