Lesson 5.11: Working with threat intelligence
Threat intelligence is other defenders' experience in a usable form: reports, indicators and techniques shared by CERTs, industry groups (ISACs) and vendors, often in the STIX format and under Traffic Light Protocol (TLP) sharing rules. Used well, it tells you what to block, what to hunt for and who you can tell. In the lab you receive a STIX bundle from a sector CERT, read its sharing restriction, extract the indicators that are still valid, sweep your DNS logs with them, and find a machine that has already contacted a domain from the report.
17 min
You will learn to
- Explain sources and levels of threat intelligence
- Read a STIX 2.1 bundle
- Apply TLP sharing rules
- Extract valid indicators
- Sweep logs with indicators and act on hits
Key terms
- Threat intelligence
- Evidence-based knowledge about threats that helps decisions: strategic (trends, for leaders), operational (campaigns), tactical (TTPs and indicators).
- STIX / TAXII
- STIX: a JSON language for intelligence objects (indicator, malware, attack-pattern, report…). TAXII: the protocol to exchange it.
- TLP 2.0
- Traffic Light Protocol, FIRST's labels for how far information may be shared: CLEAR, GREEN, AMBER, AMBER+STRICT, RED.
- ISAC / CERT
- Information Sharing and Analysis Centres (by sector) and national or sector Computer Emergency Response Teams.
- Indicator validity
- The window in which an indicator is considered reliable (valid_from / valid_until).
← Server-side request forgery (SSRF) · All lessons · Cryptographic mistakes in code →