# Threat Intelligence Quick Win

## Introduction

Threat intelligence is no simple as creating an ioc scanner and scanning the environment and then that's it you're done. It is not like that.\
\
For me, it is about adding context to the customer environment, context to alerts that analysis is triage

## IoC Sweeper or Scanner

IoC is the threat actor footprint (you can read more about the pyramid of pain right here: <http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html>) and why hashes are quite useless (<http://detect-respond.blogspot.com/2022/04/stop-using-hashes-for-detection-and.html>)

<figure><img src="https://964943629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Ml1PdlKnLbM3-EqoVLl%2Fuploads%2F8Jt7kmeJj4YdsMLujVeN%2Fimage.png?alt=media&#x26;token=4add4b81-bd42-4202-85b5-cf77d9fa1498" alt=""><figcaption><p>This is the IoC </p></figcaption></figure>

So what is an IoC Sweeper, If you read current research about threat intelligence you know one or two things about IoC - Indicator of Compromised. People start to research the threat and or get compromised then publish this type of indicator for you to check/search in your IT/OT environment to know whether you also have already compromised or not -> "Alright Cool! That sounds amazing, how can I start to create my own IoC Sweeper" \
\
Like most systems there always has input -> processing -> output (this is just a simple version so it is called quick win)

* Input: IoC feeds, threat feeds (which have IoC included), Twitter accounts that publish IoC, and many more source
* Processing: a SIEM or any platform can store network, and host artifacts that you can search against the IoC
* Output: Ayy I got a hit (Oh no I got a hit)

There are some metrics that you need to watchout&#x20;
