>> Hello and welcome to the first module, Data Collection.
In this lesson we are introducing
the first type of external data collection sources,
which is private data sources.
This lesson will be dedicated to
discover together the different types of
private data collection sources and
which type is the best fit to your requirements.
Basically, what we mean by private data sources,
threat intelligence available on paid subscriptions.
There are a plethora of
offerings from a verity of companies,
including traditional security service providers
and new specialist threat intelligence vendors.
Private or commercial data
>> collection sources can provide
>> vetted and enriched intelligence
and also up-to-date intelligence.
Some of the vendors can send
relevant and custom intelligence to their
>> customers based
>> on their activity sector or
based on the technologies used within the company.
Don't be distracted by vendors who claim to have
more than five million endpoints
or hundreds of thousands of network sensors,
because claims like this
should go in one ear and out the other.
If a vendor's collection capabilities
don't produce threat intelligence that is
relevant to your organization
and threat model then is totally useless.
Here relevance really matters.
Also some providers are more focused
on rule-based engine or predictive analytics,
while others adds additional layer
off a human analysis capabilities.
If you are talking about quality,
it can be a bit subjective
because what can to be relevant to a company A,
might be useless to a company B.
This is related to several factors,
including the sector activity,
the technologies used within the organization,
the location, the size of the company, et cetera.
Relying only on feedback or
the views is considered a bit superficial and shallow.
Here my recommendation is to define
your own use cases and
requirements before looking for
a threat intelligence solutions.
Let's start by introducing
the first type of private data collection sources.
The first type is narrative-based reports.
These reports are also known as finished intelligence.
Multiple organizations are using
threat intelligence from finalized reports.
These reports described in details,
a series of event related to
>> an intrusion or an incident.
>> Threat reports include TTPs, campaign investigation.
In some cases, they also include
attributions and now there
are new solution that are used,
the add-in ATT&CK mapping.
CTI teams need to ensure that they are properly staffed
and allocated enough time to make
the best use of this type of reporting.
Let's see the balance of advantages and
disadvantages for these type of private data sources.
When it comes to advantages,
these reports are usually rich in
detail and full of indicators.
They also give a full picture and TTPs about threats.
They describe scenarios of attacks,
attack vectors, et cetera.
Sometimes they include recommendations and
here I can add the example of advisories.
However, they take considerable time to be produced.
They are also difficult to make them actionable,
and they require custom tools
to automate the processing fees.
Here, I chose these vendors FireEye, Kaspersky,
Recorded Future, Flashpoint and,
Intel 471 as examples.
But it doesn't mean in any way
that these are all the examples or
only vendors existent in the market
or that they are the best in the market.
Because these examples I am familiar with.
Let's move to the second type of private data sources,
which is threat intelligence feeds.
I think this is
the most known type of private data sources.
Threat intelligence feeds are
real-time and continuous streams of data
that provides information on
potential cyber threats and risks.
This feeds are usually made up
of simple indicators or artifacts.
For example, a feed might present
a stream of information on malware hashes,
suspicious domains,
or IPs associated with malicious activities.
Feeds provide an easy way to get
a quick real-time look at external threat landscape.
Cyber threat intelligence feeds get
their data from sources like customer telemetry,
scanning and scrolling open sources,
honeypots or deception operations,
malware processing, and human-produced intelligence.
Not all of these sources
may be relevant to your organization.
Paid feeds should generally provide more unique data,
like data gathered from closest sources,
such as marketplaces on criminal underground.
Some paid feeds are
just aggregations of open-source feeds.
Here my recommendation is,
don't waste your money on these feeds
unless you don't have
any time to do the curation yourself.
For feeds to be actionable,
they generally need to be
>> integrated into some solution.
>> Vendors who can bring together feeds into
a single solution and add context
to data from feeds automatically will enable
you to get the maximum value
from this kind of thread content.
Also with the information provided by these feeds,
you might choose to blacklist communications
or connection requests
originating from malicious sources.
Let's move to the advantages and
disadvantages of these types of data sources.
Feeds are actionable and easy to integrate,
which is something really
important for threat intelligence.
Private feeds or paid feeds are usually up-to-date
intelligence and they are vetted information.
But at the same time,
there is still lack of context compared to reports.
These feeds come in a big volume of data to ingest,
and sometimes they even lack relevance.
Here also, I choose to mention
some example of vendors like Recorded Future again,
Malware Patrol, I-Blocklist,
TruSTAR, IBM X-Force,
and Anomali as vendors who
provide threat intelligence
>> feeds on paid subscriptions.
>> These are not the only providers within the market
and these are not the best solutions in the market.
I didn't make a comparison between these solutions,
but these are examples that I'm familiar with.