What is a Threat Intelligence Platform (TIP)?
A threat intelligence platform, or TIP, is used to collect, manage, and share threat intelligence.
Purpose of a Threat Intelligence Platform
Today’s cybersecurity landscape is marked by a few common issues – massive volumes of data, lack of analysts, and increasingly complex adversarial attacks. Current security infrastructures offer many tools to manage this information but little integration between them. This translates to a frustrating amount of engineering effort to manage systems and an inevitable waste of already limited resources and time. To combat these issues, many companies are choosing to implement a Threat Intelligence Platform (TIP).
Threat Intelligence Platform (TIP) Definition:
Threat Intelligence Platforms can be deployed as a SaaS or on-premise solution to facilitate the management of cyber threat intelligence and associated entities such as actors, campaigns, incidents, signatures, bulletins, and TTPs. It is defined by its capability to perform four key functions:
- Aggregation of intelligence from multiple sources
- Curation, normalization, enrichment, and risk scoring of data
- Integrations with existing security systems
- Analysis and sharing of threat intelligence
Breaking Down "TIP"
Threat
The potential for any other party to access or interfere with the normal planned operations of an information network. Common threats today include:
Intelligence
Knowledge of a threat gained by human analysts or identified by events within the system. Intelligence is a broad term, but a TIP presents analysts with specific kinds of intelligence that can be automated, including:
Platform
A packaged product that integrates with existing tools and products, presenting a threat intelligence management system that automates and simplifies much of the work analysts have traditionally done themselves.
Who Uses a TIP?
A Threat Intelligence Platform is useful to many parties within an organization.
Security Operations Center (SOC) teams
ThreatStream customers can easily trial and purchase threat intelligence from APP Store partners. Find the right intelligence for your organization, industry, geography, threat type, and more.
Threat intelligence teams
ThreatStream customers can trial and purchase data enrichment services, sandboxes, and other analytic tools directly from Anomali APP Store partners. Identify the right enrichment data and analysis tools to add context to your indicators.
Management and executive teams
ThreatStream provides the industry’s most complete set of proven, turnkey integrations into leading enterprise SIEM, EDR, firewall, SOAR, and other security controls, delivering fast time to value.
Data Aggregation
A Threat Intelligence Platform automatically collects and reconciles data from various sources and formats. Ingesting information from a variety of sources is a critical component to having a strong security infrastructure. Supported sources and formats include:
Sources:
Formats:
Normalization and Enrichment of Data
Collecting data across a wide variety of threat intelligence feeds results in millions of indicators to sort through per day, making it vital to process data efficiently. Processing includes several steps but is comprised of three main elements- normalization, de-duplication, and enrichment of data.
These are expensive to address in regards to computational exertion, analyst time, and money. A Threat Intelligence Platform automates these processes, freeing analysts to analyze rather than manage collected data.
TIP Integrations
Data that has been normalized, vetted, and enriched must then be delivered to systems that can use it for automated enforcement and monitoring. The purpose of this is to provide these technologies with what is essentially a “cyber no-fly list”, much like the kind of no-fly list you might encounter at an airport. Based on background knowledge, certain IPs, domains, and more should not be accessed or allowed within the network.
A Threat Intelligence Platform works with SIEM and log management system vendors behind the scenes, pulling down indicators to push across to security solutions within the customer network infrastructure. The burden of establishing and maintaining these integrations is therefore lifted from the analysts and instead shifted over to the SIEM and TIP vendors.
Possible security product integrations include:
Threat Analysis and Response
A Threat Intelligence Platform provides features that aid with analysis of potential threats and corresponding mitigation. More specifically, these features help analysts to:
A TIP will take all the possible data, enrichments, and other context available and display this information in ways that provide value, such as in dashboards, rulers, alerts, and notes.
A Threat Intelligence Platform also aids analysts by automating the research and collection processes, significantly reducing response time. Some specific functionalities of the analysis part of a Threat Intelligence Platform include:
The Latest Threat Intel News
Stay ahead of adversaries with more threat intelligence guides and tips from Anomali.
