Threat Intelligence Protection

A successful TIP needs to be able to do at least the following:

• Gather information from all available TI sources defined as per the customer’s need, either externally or internally – in confidence.
• Provide correlation, enrichment, and validation to information, based on specific customer requirements, to provide Operational, Tactical and Strategical information.
• Provide the ability to share information while maintaining privacy whenever needed.
• Provide Actionable Intelligence that derives a decision and being able to support that decision by taking the right actions as a part of the customer’s team of tools. This must be driven by the TIP, in integration with SOAR, SIEM, IPS, FW, etc.

A TIP is not just nice to have in a mature environment, it is a must-have to acquire a mature environment. As per Garter, TIP is part of a comprehensive SOAR function.

A successful TIP should be the go-to platform for information and analysis and should be usable and beneficial for the TI team, SOC team, IR team, TH team and the CISO.

While defining the use cases for a TIP is very relevant and tailored to the customer's requirements, building the right workflows and playbooks is totally dependent on different criteria, below are some sample use cases that can be common.

• Correlating and disseminating relevant IOCs to different devices in a timely manner
• Enrichment and analysis of information including but not limited to IOCs, TTPs, Actor Profiles.
• Providing prioritization to existing vulnerabilities based on all information provided from different sources internal and external
• Handling phishing emails and providing a suitable analysis to enhance decision-making
• Monitoring of specific assets on DDW and correlating that to existing or possible threats
• Operationalizing Malware Analysis.

A TIP as a standalone component will be very valuable to an entity with the right teams and a mature approach, but the TIP has to be able to initiate and manage actions to add the right value. Hence, as per Gartner, TIP is tied up to SOA and IR to provide a SOAR functionality in its full power. The goal of every provider is to be able to maximise their offering, both by integrations and by building the functionalities within their platforms. The aim of any Intelligent Operations process is to provide the capabilities of understanding, actioning and learning as a continuous cycle of actions within any SOC.