Small Cyber Threat Intelligence Program

This is my journey to build a small Threat Intelligence Program

Overview of Cyber Threat Intelligence and CTI Requirement

Refs

When I studied and learned about CTI there was a cycle that at first I overlooked but now I realize it is very crucial to understand this cycle, which is the CTI Life Cycle

The first thing in CTI is to have a requirement

Who defines the requirements?

You try to answer a question from your employer, your C-level, or for yourself. Such questions could be vague and broad for example:

Is our company likely to be a target for a ransomware attack?
What adversaries might attack our company?

Intelligence Direction

To be sure that the most relevant and most critical information is processed and not lost into the noise.

Establish a Request for an Information Portal (PFR) or Priority Intelligence Requirement (PIR)

This can enable SOC, C-level, and customer to create an intelligence requirement request such as:

Trend Reports
Threat Profile
Cyber Threat Advisory
...

Collection - Good Feeds/Tools and Connectors

After you have your requirement you now need to collect the data and all the telemetry, the historical and related data to the requirement.

The second step of TI is to collect data, the first step is the direction (which is not the purpose of this guide). There are 3 types of information sources:

Internal Source (network traffic, logs, scans)
Technical Source (Vul DB, Threat Feeds, OSINT) → free feed or paid free, or could be malware repository or C2 scanner
Human Source (Dark Web, Social Media, Forums, Cyber Security Blogs, and Feeds) → It is very hard and needs a dedicated person and training to penetrate and collect data

Telegram Info-Stealer Monitoring

Some feeds require you to send them an email so that have access to their feed, create a PGP key, and send them an email