Transform Your CTI Program With the Anomali Threat Platform: Exploring 5 Common Use Cases

<p>In this blog, we will be looking at a few popular use cases of Anomali Match™, one of the core components of the Anomali Threat Platform. Anomali Match is a powerful tool that addresses an industry-wide dilemma on how to leverage threat intelligence effectively. A key issue with most tools is that they do not understand TTPs, campaigns, threat bulletins, and other components of the threat model, and thus cannot provide context around indicator of compromise (IOC) matches. Anomali Match solves this major problem by identifying relationships across the entire threat model around IOC sightings within your environment.</p><h4>1. Evolve from IOC-centric detection by leveraging the entire threat model</h4><p>Anomali Match can provide strategic value on intelligence via threat model relationships. This moves the needle away from commonly seen “atomic indicator” type of IOC data, and starts giving you incredible information from which to base your investigations and incident response activities.</p><p>Within the threat model, you will, among other things, be able to see context such as related threat bulletins, incidents, actor profiles, campaigns, TTPs, and vulnerabilities.</p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/GIE903dET76CoUu7AXV9"/></p><h4>2. Take advantage of the MITRE ATT&CK framework within your organization</h4><p><a href="https://www.anomali.com/resources/what-mitre-attck-is-and-how-it-is-useful" target="_blank">MITRE ATT&CK</a> (Adversarial Tactics, Techniques, and Common Knowledge) is a living, growing knowledge base of adversary tactics and techniques based on real-world observations. Anomali has integrated this framework into Anomali Match, allowing matching across strategic intelligence such as threat bulletins, actor profiles, TTPs, and campaigns that reach across the ATT&CK framework. As an example, this capability can allow indicators to be associated with threat actors to understand their TTPs.</p><p>The ATT&CK matrix is visually integrated into Anomali Match, highlighting TTPs that are being leveraged in a sighting, and immediately provides additional context around the observable in question. </p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/5wCn6R3HQAiLixj5fvmx"/></p><h4>3. Prioritize efforts by using vulnerability scans in conjunction with matches to compute an overall risk score on endpoints</h4><p>Anomali Match introduces the ability to calculate an overall risk score for assets within your environment. By allowing the ingestion of reports from vulnerability assessment (VA) tools such as Qualys, having the ability to assign different criticalities to each asset or asset class, and factoring in intelligence matches, Anomali Match becomes a central decision point for understanding effort prioritization.</p><p>Each score is computed using an aggregate of VA information, asset criticality, and intelligence sighting, providing the operator with a concise view of impacted hosts. </p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/Kz7EeyuvSa64D6aoqZBe"/></p><h4>4. Evaluate historical exposure to newly identified threats</h4><p>A common approach to leveraging threat intelligence inside organizations is to ingest it into the SIEM for correlating matches. While this can be acceptable in a few scenarios, it does have certain limitations:</p><ul><li>These tools are usually limited in terms of data retention periods. Typically, a large subset of logs are kept in cold storage, meaning forensic lookups usually involve restoring logs from backup.</li><li>Matches require parsing of raw log data, which can be costly in terms of performance and utilization.</li><li>Matches do not utilize the entirety of the threat model.</li></ul><p>Anomali Match is a purpose-built tool that solves these common issues. By backfilling data from the SIEM and only keeping metadata that can be matched with threat intelligence, this means that:</p><ul><li>Retention periods are almost limitless.</li><li>Searches across large datasets complete in near real-time.</li><li>Results are more comprehensive since they match across the entire threat model.</li></ul><p>According to a recent Ponemon <a href="https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=SEL03130WWEN&" target="_blank">study</a>, the average time-to-detection for data breaches sits at 191 days. Therefore, it is critical for organizations to not only be able to detect threats, but also have the ability to evaluate historical exposure when threats are discovered.</p><p>Anomali Match allows for automated retrospective lookups on new intelligence matches in your environment at speeds and scales other tools can’t come close to. </p><p style="text-align: center;"><img alt="" src="https://cdn.filestackcontent.com/CRUCNADRbuNAPN7jnbop"/></p><h4>5. Identify IOCs within your environment across multiple tools</h4><p>Organizations typically employ a variety of different tools in their security stack. For example, an organization could be using EDR, IDS, SIEM, and firewall technologies. Each of these tools can generate a considerable amount of log data.</p><p>Anomali Match has the ability to ingest data from various tools like the ones previously mentioned, as well as other common sources such as TAP, SPAN, syslog, and BEATS. This capability allows Anomali Match to report sightings across the multiple tools usually present in a modern security stack.</p><p style="text-align: center;"><a class="button button-xlarge button-rounded button-blue-grad" href="https://www.anomali.com/request-a-demo" target="_blank">Check it out for yourself</a></p>