Common Use Case for Technical Threat Intelligence
ANY.RUN - Interactive Malware Analysis Service
An innovative threat hunting tool for malware analysis and incident response.
Cyber Threat Intelligence is a powerful tool that helps organizations make sense of the vast amounts of data generated by their cybersecurity systems.??
This data provides insights into the specific details of an organization’s security posture. It enables security teams to identify risks, anticipate potential threats, and assess the effectiveness of their remediation methods.?
?? The Three Levels of Cyber Threat Intelligence??
To effectively combat cyber threats, it’s essential to understand the three levels of CTI: tactical, operational, and strategic.??
1?? Tactical intelligence??
Tactical CTI identifies specific, real-time threats, enabling swift and appropriate responses. It focuses on specific, identified threats rather than abstract, potential risks.??
Types of tactical TI data:??
2?? Operational intelligence??
Operational CTI is designed for security managers and network defense teams who need technical details about potential attacks while understanding broader trends.?Operational CTI is updated frequently (daily or every few days) to ensure the effectiveness of the cybersecurity infrastructure.??
Types of Operational CTI Data:??
3?? Strategic intelligence??
Strategic CTI identifies the actors targeting an organization and their motivations. It is designed for high-level decision-makers, such as executive boards and C-level executives, responsible for the overall direction of the organization.??
Types of strategic CTI data:??
?? What is Technical Threat Intelligence????
Technical Threat Intelligence focuses on indicators of immediate compromise like IP addresses or domains.?It helps SOC teams configure the security systems that are the first line of defense against known and emerging threats.?
领英推荐
This data is typically machine-readable. Systems like TIP, SIEM, IDS/IPS and EDR can ingest and operationalize it, and SOC teams can then create new security rules or enrich existing ones.????
All popular security solutions can read technical TI data because they use a common format for sharing threat information — STIX.?
STIX is essentially JSON that’s been modified to better build connections between data elements likened indicators, tactics, techniques, and threat actors.?
???? What are common use cases for Technical TI???
Technical TI revolves around collecting, analyzing, and disseminating threat data, which comes from TI Feeds and malware analysis sessions.???
This data includes:??
Here’s how different security teams use this data:??
SOC analysts?can load threat intel feeds into their SIEM and IDS/IPS to identify attacks in real-time. When the systems detect a known bad IP connecting to the network, analysts can immediately block it and investigate further.??
Incident responders?use threat intel reports to quickly identify the root cause of a breach. For example, they can look up the specific servers a malware connects to, block those IPs in their firewalls, and scan the network for any compromised devices communicating with those addresses.??
Vulnerability managers?use threat intel to prioritize patching. They focus on vulnerabilities that are actively being exploited in the wild based on threat reports, rather than trying to patch everything at once. This helps them fix the most critical issues first and reduce risk more efficiently.?
?? Where does Technical TI data come from???
Technical TI data comes from threat feeds and malware analysis sessions, both manual and in sandboxes.?
TI feeds ?provide a stream of real-time data about new and emerging malware from an external source and plug into SIEM and TIP systems to constantly update them with new indicators.
Sandbox analysis sessions?allow analysts to place and run malware in a controlled environment, while the malware sandbox collects and records all system events related to its activity. Analysts can then access this data through reports.
?? Using technical TI to collect threat data??
With services like TI Lookup , security teams can get a holistic understanding of the threat they’re dealing with. For example, if a security team member notices unusual DNS connections to an IP they don’t recognize, they can use #ANYRUN’s Threat Intelligence Lookup to quickly query that IP address.???
#ANYRUN will provide more related evidence, like domain names, file hashes and ports — along with tactical intelligence: associated malware families and TTPs. With that information, you can determine if this is an intrusion and take steps to contain and remediate it.?
SOC teams operationalize this data to monitor system and network logs, automatically detecting and alerting entries that match known threat intelligence indicators.???
?? Analyze and Investigate Cyber Threats with #ANYRUN
Strengthen your security with #ANYRUN’s malware analysis and threat intelligence capabilities.?