Utilizing Threat Intelligence Feeds for SOC/DFIR Teams: A Guide

Hey there, Bay Area friends! How about we talk about something that’s on the minds of a lot of people in healthcare and cybersecurity these days? Yep, you guessed it – we’re talking about the mysterious world of threat intelligence feeds.

So, what are these threat intelligence feeds that everyone is talking about? Well, they are real-time streams of data that alert us about potential cyber threats; these threats can be anything from risky IPs to harmful URLs. The best part is that this data can be absorbed and understood by security systems, helping to identify and block possible threats. Sounds cool, right?

Now, there are two types of these threat feeds out there. We’ve got commercial threat intelligence feeds and open-source threat intelligence feeds.

Commercial feeds are the superheroes of the cybersecurity world that hunt down and collect threat data, making sure it’s trustworthy and accurate. They can even provide additional context by linking indicators to sandbox sessions, which allows for direct observation of threat behavior.

Open-source feeds, on the other hand, offer an ocean of community-sourced threat data. While this can mean more data to wade through and potential inaccuracies, thanks to the vast scope and the community’s involvement, this source can still offer extensive coverage. Some pretty well-known examples include the Automated Indicator Sharing from DHS, the FBI’s InfraGard portal, and the Internet Storm Center from SANS.

Now, for staying safe and secure, we recommend using both types of feeds. Why? Because while commercial feeds provide you with the most timely and relevant threat data, open-source feeds can give you that extra breadth of coverage. It’s pretty much having the best of both worlds.

But a little word of caution, friends – don’t let yourself be overwhelmed by alerts from your feeds! Filter based on the source’s reputation, the age of the indicator, and other contextual information, so your team only focuses on the genuine threats.

Alright, are you with me so far? Great!

Now you might be wondering, “How do I even make sense of all this stuff coming from these feeds?” Well, the data from these feeds come in a format known as STIX (Structured Threat Information Expression). They’re designed for easy exchange across different security systems.

But how do you actually put this data into action? That’s where systems like Security Information and Event Management (SIEM) and Threat Intelligence Platforms (TIP) come into play. SIEM systems collect, analyze, and make sense of security events from multiple sources. TIP systems add context to indicators to give you a more complete picture of the attack. This helps you make better decisions and prioritize effectively.

Then it’s just a matter of configuring the systems to take in new data at the right frequency, and enriching the data with additional context like techniques and procedures to identify threats and make better response decisions.

Once you’ve enriched the data, you can set rules for your SIEM system to sift through this data and logs from various sources. These rules will look for anything fishy, like linked IP addresses or domains known for dodgy activities, and respond accordingly.

And that’s it! You’re set up for a safer, more secure digital landscape.

Remember, folks, in our digital world, staying ahead of threats is just as important as response and recovery. So let’s keep our eyes open, use our resources wisely, and work together to make the Bay Area a safer place for all. Thanks for tuning in, and catch you next time!

by Morgan Phisher | HEAL Security