Alienvault otx rss manual#

Once this data is inspected for applicability, it must then be validated against evidence found within the impacted organization. The pivot process takes the retrieved individual IoC data points (listed in IoC section) and attempts to pull relevance against the retrieved threat data.

Alienvault otx rss manual#

This is where tactical manual verification and IoC pivoting takes over. Using threat intelligence automated feeds and frameworks is definitely helpful for rapid mass consumption of the threat data, but it still doesn’t provide actionable threat-related data. The intelligence gathered can provide an organization with greater understanding of their security exposure, as well as add critical incident telemetry and best-case scenario threat actor or threat group attribution. Within Incident Response, the end goal is to derive useable IoC threat intelligence, which is why it is paramount to scrutinize the retrieved threat data. Collective Intelligence Framework (CIF) ( ).

Your Everyday Threat Intelligence (YETI) ( ).

Malware Information Sharing Platform (MISP) ( ).

Sample of Threat Intelligence Frameworks: To assist with automated aggregation of the threat intelligence gathering process there are also a number of open source threat intelligence frameworks available.

Information sharing and Analysis Organizations (ISAO).

National Cybersecurity and Communications Integration Center (NCCIC).

Industry/Sector Information Sharing and Analysis Centers (ISAC).

There are also paid threat intelligence monitoring services, but we will focus on what is readily available to any analyst. This supporting metadata can be obtained through threat intelligence feeds, threat sharing groups, and by using a tactically driven manual search methodology (covered in the next section). There is definitely not a shortage of available threat data, so it is crucial to maintain focus on data that is relevant to the impacted organization. We will be focusing primarily on available Open Source Intelligence (OSINT) data, but understand that there are critical resources within the darknet to scour for deeper levels of threat perspective. In order to add meaning and greater significance to the retrieved IoCs, it is necessary to sift through the mountain of existing threat data. If you haven’t had a chance to read the first part of this series, take a few minutes to get caught up and then jump back into part two, where I will cover: threat data saturation and the arduous indicator pivoting and analysis process. In part one of this blog post series, we briefly looked at why IoC threat data enrichment is important, the value of knowing who your enemy is, and the process of turning threat data into threat intelligence.

By Justin Vaicaro in Incident Response, Incident Response & Forensics, Threat Hunting