Digital Forensics and Incident Response - Second Edition

Proactive threat intelligence

Threat intelligence providers will often provide CSIRT and SOC teams with threat intelligence that can be easily fed into their SIEM of choice. This allows these teams to enhance their detective capability with intelligence that is timely, possibly allowing them to keep pace with the current threats and increase the probability that they will detect one or more of these threats before damage can be done.

In the MISP platform, events with specific IOCs can have those IOCs converted into several different types of detective rules. For example, an organization is concerned about ransomware impacting the organization and wants to enhance their detective capability. Event number 225 in the MISP platform is associated ...