Hello and welcome to this third
lesson, integration and storage,
an important part of data
processing.
In this lesson, we will discover
together how crucial is
storing and integration of
indicators in cyber threat
intelligence context.
After collecting data from multiple
sources, this data
goes through multiple steps
of processing and the
output information should be
conservate to be consumed in the
future.
This process of data could also
be integrated with security
products that are used within the
company.
Keep in mind that most of the threat
intelligence platforms allow
all processing stages
by the same software.
But you can create your own tools
to integrate your output
information into your security
tools.
Now let's see how important
is storing of indicators.
The final stage of data processing
is storage.
After all of the data is processed,
it is then stored for future
use, including temporal
analysis and campaign analysis.
While some information may be put
to use immediately, much
of it will serve a purpose later
on.
Plus, properly
stored data is a necessity
for compliance with data
protection legislations like the
DPR.
When data is properly start,
it can be quickly and easily
accessed by members of the
organization when needed.
When it comes to integration,
integration is a key requirement
for a cyber threat intelligence
because actionable indicators
need to find a way back into
your security devices and products
that are used within your
organization.
And here is a recommendation.
Please avoid integrating
noncommitted or nonrelated feeds
into your active security devices
because it is going to generate
a lot of noise and a lot of
alerts for your analysts.
This video was a quick lesson
to introduce the importance
of storage of processing
data and the importance
of integration of actionable
indicators within your
infrastructure.
In the next video will cover also
another important part of cyber
threat intelligence, which is threat
intelligence platforms.