>> Hello and welcome to this lesson.
Fully dedicated to threat intelligence platforms.
In this video, we will go through a quick reminder of
Threat Intelligence platforms definition
>> and we will see who are the teams
>> that are using threat intelligence platforms
>> and we will discover it together
>> some common capabilities offered by these platforms
>> and we'll finish this lesson by exposing
>> some products that are available on the market.
As a reminder of the definition
>> that you've already seen in a previous lesson
>> about external data collection sources
>> a threat intelligence platform is defined
>> as a piece of software where
>> you can organize one or more
feeds into a single stream of threat intelligence
>> and that you can use to get alerts and manipulate data.
>> Threat Intelligence platforms
>> can be used by multiple teams
>> who are involved directly or indirectly
>> with cyber threat intelligence,
>> such as security operation center or SOC teams,
where threat intelligence platforms provide
automation to the operational day to day tasks.
Second, we find threat intelligence teams
>> who use threat intelligence platforms
>> to make assessment
>> and predictions based on context
>> that was enriched through
>> the available information within the platform.
Third, we find executive and management teams
>> who use threat intelligence platforms
>> that can provide for them dashboards
>> and display threat trends
>> to help them to make decisions.
Now we can move to the common features
offered by threat intelligence platforms.
In this context,
>> I normally create a diagram that summarizes
>> most of the common capabilities
>> that any threat intelligence platform
>> should be able to assure,
which are collect, manage, and integrate.
A threat intelligence platform automatically collects
>> and ingests data from various sources and formats.
>> Supported sources can be open source or free feeds,
paid or premium feeds, finished reports,
standardized threat files,
feeds from an ISAC or ISAO.
A threat intelligence platform should also
be able to process or manage collected data.
Processing includes several steps,
but in this case,
comprised of sorting, normalization,
duplication, and enrichment of data.
A threat intelligence platform automates
>> these processes,
>> freeing analysts to analyze
rather than to manage collected data.
Finally, data that has been normalized, vetted,
and enriched, must then be delivered to systems
>> that can use it to improve threat detection.
>> The first example of threat intelligence platforms
>> that you are going to see in this lesson
>> is OTX or Open Threat Exchange,
>> which is a Cloud-based platform
>> developed by Alienvault.
>> It is one of the biggest community
threat sharing platforms
>> with more than 19 million potential threats
>> shared on a daily basis.
OTX can act as a TAXII server,
which makes it easy to integrate
with other threat intelligence platforms.
Here is an overview of what OTX dashboard.
You can subscribe to a contributor
>> in order to receive their pulses
>> and ingest the indicators into
>> your own security monitoring tools using your API key.
The OTX community reports
>> and receives threat data into the form of pulses.
>> OTX pulses provides you with a summary of threat,
the iterated IOC's and other details.
If you are interested in trying this platform,
you can find the full documentation
available on the platform.
Our second example is
MISP or malware information sharing platform,
which is open source
>> threat intelligence platform for sharing,
>> storing, and correlating indicators of compromise.
It's a repository of malware, IOC's,
>> and cyber threats related to technical information.
>> Each package of information
>> in the platform is called an Event.
>> These events are made up of Attributes.
Here is a sample of Events
>> that are displayed on the MISP interface.
>> Through this interface,
>> you can list all the events available on your platform.
>> You can add new events.
You can also list attributes or search for attributes.
These are not the only functionalities offered by MISP.
You can find other functionalities in the documentation
>> which is available on the MISP Book project
>> and the link is displayed on this slide.
Our third example is CRITS,
or collaborative research into threats,
which is an open source malware
>> and threat repository that leverage
>> other open source software to create
a unified tool for analysts and security experts.
It was created to give analysts
>> a better way of storing,
>> enriching, and discovering threat data.
You can deploy your CRITS instance locally
>> for a private isolated environment
>> or shared among other trusted organizations.
>> Here is a sample dashboard
>> that can be offered by CRITS.
>> Here, the account section, for example,
is a general overview of the quantity
>> of some of the data available on the system.
>> The top backdoor section
shows the most popular backdoors,
assign it to samples in your database.
The top campaigns section shows
>> some of the most popular campaigns
>> that you've added to your CRITS instance.
The recent section shows some of the newest objects,
editor creates instance that may be of interest to you.
Of course, you can find the full documentation
>> on the projects GitHub repository.
>> The link is displayed on the slide.
Our next example is ThreatConnect platform.
Just to avoid some confusions,
ThreatConnect offers a paid and free platform
and here in our example,
we are talking about the free cloud
based threat intelligence platform that is accessible
>> via the links displayed on this slide.
>> ThreatConnect connect have the same common features
that can be offered
>> by any threat intelligence platform.
>> It is supported by a big community
>> that share threats on a daily basis.
>> One of the interesting features that is offered
>> by ThreatConnect is orchestration.
>> ThreatConnect offers the ability to establish
processes with playbooks and workflows.
Here is an overview of the platforms dashboard.
It displays top collection sources,
latest finished reports that are
added to the platform and top tags.
Of course, this dashboard is only a generic one,
but if you're interested
>> in personalizing your own dashboard
>> using your own indicators of
>> compromise and your own interests,
then you can personalize or customize
your dashboard according to your preferences.
Our final example will be STAXX.
STAXX is also an open source platform
>> offered by Anomali.
>> STAXX is compatible with STIX
>> and TAXII standards and comes p reconfigured
>> with a free TAXII feeds called LIMO.
>> We've already seen LIMO in previous video
>> where we talked about TAXII servers
>> and also when we talked about feed aggregators.
>> Through the online portal,
STAXX offers enrichment
>> for the indicators including confidence,
>> severity, threat scar, passive
DNS, and WHOIS information.
Here is an overview of the platforms dashboard,
that displays threat trends over the past seven days.
You can directly get this dashboard
>> after properly deploying STAXX into your environment
>> and enabling LIMO feed aggregator.
>> In this video, we have the chance to talk in
more details about threat intelligence platforms,
including who uses them, their capabilities,
>> and I shared with you few examples of products.
>> I choose products that are available for free
or that dedicated some functionalities for free.
Of course, these examples are not
the only existing products in the market.
As you can see, data processing is
really important phase of the intelligence cycle.
However, it is really time consuming
>> and it is ideal to automate it and to my opinion,
>> teams should dedicate more time
>> to analyze this phase then later processing.
>> This is why it's time to move
>> to the next module about analysis and production.