Acquiring threat information
The first requirement for threat intelligence is a reliable source of threat information, a way to get the latest information about threat IOCs.
Here are some IOC sources:
- Your own incidents and threat hunting efforts
- Vendor reports
- Your own honeypots
- Peers and sharing communities
- External/third-party free and paid-for feeds:
Some vendors, such as FireEye, CyberX, and Nozomi, offer these kinds of intel feeds with their tools.
Let's go through these sources in detail.
Your own incidents and threat hunting efforts
The best threat information comes from internal activities and resources. The reason for this is that this information is directly relevant to your environment, which is where it came from. Get into the habit of generating lists of discovered host names, IP addresses, URLs, DNS queries, filenames, file hashes, and any information surrounding the location and situation this information was found in. Before...
