Threat intelligence

As explained in Cyber Threat Hunting

A document that communicates analyzed information about threats, adversaries, vulnerabilities, capabilities, activities, or indicators.

Threat intelligence is collected and processed knowledge about cyber threats from internal and external sources. It helps teams assess threats that occurred, are active, or may emerge, so they can make timely decisions about who might attack and how. Analysts research, analyze, compile, and share this information with teams such as threat hunting. section 2.3 section 13.3.3

Useful intelligence is structured for its audience and actionable for its consumer. Strategic intelligence describes the threat landscape for executives; operational intelligence gives security management and hunters actor context; tactical intelligence details TTPs; and technical intelligence supplies machine-consumable IOCs such as IP addresses, hashes, and URLs. Technical indicators are short-lived, while operational and tactical intelligence are especially useful for building hunts. section 2.3.1 section 13.3.3

Figure 2.1 Threat intelligence types

Compare the four intelligence types by audience, level of detail, and intended use. section 2.3.1

Turning a report into a hunt

A report on active exploitation of CVE-2021-24347 in a WordPress file-upload plugin combines vulnerability details, organizational relevance, IOCs, and TTPs. A hunter uses it to create a web-shell hunt: define a hypothesis, scope public web servers, map likely techniques, and search web-access and cloud-firewall events. Findings and newly uncovered TTPs then feed back to the intelligence team. section 4.1.2 section 4.3.1 section 4.6

Use threat intelligence in a repeatable hunting workflow:

• Receive an urgent, actionable report and create a hunting play using its background, indicators, techniques, and affected scope. section 4.3.1
• Check whether available event sources provide enough visibility to answer the hunt’s questions, and record collection or configuration gaps. section 4.4 section 4.6
• Coordinate with threat intelligence, vulnerability management, system administration, and incident response; share findings and escalation information. section 4.6

How Cyber Threat Hunting covers it

How deep it goes

Distinguishes four intelligence types and works a report through hunt preparation, while deferring container-deployment security investigation.

Examples

Uses an exploited WordPress plugin vulnerability, web-shell upload, web-access logs, cloud-firewall events, and a PHP web-shell artifact.

What it assumes

Assumes familiarity with security operations while introducing intelligence types and their consumers from an operational perspective.

What you can do after

Apply it via threat-hunting plays that translate actionable reports into scoped hypotheses, data searches, and team feedback.

How it connects

Connects threat intelligence to threat hunting, vulnerability management, MITRE ATT&CK, incident response, IOCs, and TTPs.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat huntinguses · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• natural language processingused by · Natural language processing is the field of computing concerned with computationally analyzing, interpreting, transforming, or generating human language.
• Wazuhused by · Wazuh is an open-source security platform for threat detection, file-integrity monitoring, vulnerability detection, and compliance analysis.
• Microsoft Sentinelused by · Microsoft Sentinel is a cloud-native security information and event management and security orchestration, automation, and response platform.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.