I Told You So, Volume 1 - cti-standardsArchive, Volume 1: conference talks and papers on security and risk, 2010 to 2018.Zola2015-10-20T00:00:00+00:00https://blog.itys.net/vol1/tags/cti-standards/atom.xmlThreat Intelligence 101: Introduction and Foundations2015-10-20T00:00:00+00:002015-10-20T00:00:00+00:00
Unknown
https://blog.itys.net/vol1/posts/threat-intelligence-101/<h2 id="summary">Summary</h2>
<p>The Cyber Security Summit 2015 presentation Threat Intelligence 101:
Introduction and Foundations by Matthew J. Harmon provides an entry level
overview of the role and practice of cyber threat intelligence (CTI). Harmon
begins by framing the inevitability of breaches citing high-profile incidents,
and the principle that attackers need only one success, then introduces CTI as
the structured collection and sharing of Indicators of Compromise (IoCs)
enriched with context to support detection and response.</p>
<h2 id="foundations">Foundations</h2>
<p>He then explains the foundational CTI standards, CybOX (the vocabulary of
observables), STIX (the XML based language for packaging observables into
indicators, incidents, TTPs, and courses of action), and TAXII (the protocol for
exchanging STIX packages) and walks through a real-world example: from spotting
anomalous server traffic to extracting email, hash, IP, and URL indicators;
packaging them into a STIX header; and sharing via TAXII to uncover a broader
campaign.</p>
<h2 id="diy">DIY</h2>
<p>Finally, Harmon showcases two CTI platforms ThreatConnect (expertcurated
CybOX/STIX feeds) and CriticalStack Intel (aggregated open-source IoCs in TSV
for Bro integration) and outlines a hands-on lab using Bro or Security Onion and
CriticalStack feeds. This culmination demonstrates how organizations can do it
themselves by deploying free tools, subscribing to feeds, automating IoC
ingestion, and participating in community-driven neighborhood watch initiatives
to elevate their collective security posture.</p>
<h2 id="presentation">Presentation</h2>
<p><a href="/attachments/57315_2015-10-20_Threat_Intelligence_Intro_And_Foundations-CSSummit.pdf">Threat Intelligence
101</a></p>