Cybersecurity Blue Team Strategies

9

Cyber Threat Intelligence

In the previous chapter, we understood how a blue team should ideally go about selecting, deploying, and monitoring security controls in their organization. We also understood how a Security Operations Center (SOC) team can get overloaded with too many logs to sift through to identify a potential threat. In this chapter, we will look into how CTI can alleviate some of these concerns and help the blue team identify any potential threats in their organization.

The following topics will be discussed in detail in this chapter:

• What is CTI?
• Types of threat intelligence
• Threat intelligence implementation
• Threat hunting
• The MITRE ATT&CK framework

What is CTI?

Cyber Threat Intelligence (CTI) can be defined as data that ...