- [Instructor] A threat intelligence platform
centralizes the collection of threat data
from numerous data sources and formats.
The volume of threat intelligence data can be overwhelming.
So the threat intelligence platform
is designed to aggregate the data in one place.
And most importantly, present the data
in a comprehensive and usable format.
The threat intelligence platform
is an emerging technology discipline
that helps organizations aggregate,
correlate, and analyze threat data
from multiple sources in real-time
to support defensive actions.
The threat intelligence platform or TIP
is an emerging technology discipline
that helps organizations aggregate,
correlate, and analyze threat data
from multiple sources in real-time
to support defensive actions.
TIPS have evolved to address
the growing amount of data generated
by a variety of internal and external resources,
such as system logs and threat intelligence feeds,
and help security teams to identify
the threats that are relevant to their organization.
By importing threat data
from multiple sources and formats,
correlating that data and then exporting it
into an organization's existing security systems
or ticketing systems,
a TIP automates proactive
threat management and mitigation.
A true threat intelligence platform
differs from typical enterprise security products
in that it is a system that can be programmed
by outside developers in particular users of the platform.
TIPS can also use APIs to gather data
to generate configuration analysis
who is information reversed, IP lookup,
website content analysis,
name servers, and SSL certificates.
Many different threat intelligence platforms
and services are available in the market nowadays.
Cyber threat intelligence focuses
on providing actionable information
on adversaries, including IOCs.
Threat intelligence feeds help you
prioritize signals from internal systems
against unknown threats.
Cyber threat intelligence allows you
to bring more focus to cybersecurity investigation.
Because instead of blindly looking
for new and abnormal events,
you can search for specific indications of compromise,
such as IP addresses, URLs, or exploit patterns.
A number of standards are being developed
for disseminating threat intelligence information.
Here are a few examples.
First, structured threat information
expression or STIX,
which is an express language designed
for sharing of cyber attack information.
STIX details can contain data,
such as the IP address or domain names
of command and control servers,
often referred to C2 or C&C,
as well as malware hashes and so on.
STIX was originally developed by MITRE
and is now maintained by OASIS.
The trusted automated exchange of indicator information,
or TAXII, is an open transport mechanism
that standardizes the automated exchange
of cyber threat information.
TAXII was also originally developed
by MITRE and is now maintained by OASIS.
Cyber observable expression or CybOX
is a free standardized scheme
for specification, capture,
characterization and communication of events
of stateful properties that are observable
in the operational domain.
CybOX was originally developed by MITRE
and is now also maintained by OASIS.
Open indicators of compromise or OpenIOC
is an open framework for sharing
threat intelligence in a machine digestible format.
And open command and control or OpenC2
is a language for the command and control
of cyber defense technologies.
The OpenC2 forum was a community
of cybersecurity stakeholders
that was facilitated by the US National Security agency.
OpenC2 is now an OASIS
technical committee and specification.