Threat intelligence overview

Before we look at its role in detection engineering, we must understand what threat intelligence is. Cyber-threat intelligence is data collected and analyzed in order to understand the context related to emerging or existing threats. It can help us understand a threat actor’s motives; targets; tactics, techniques, and procedures (TTPs); and more. This in turn can help us understand how we can detect such threats. At the simplest level, threat intelligence may be provided in the form of indicators. For example, URLHaus by AbuseDB includes lists of malicious URLs that can be accessed by API: https://urlhaus.abuse.ch/downloads/text/. There are many open source feeds that will provide a list of known malicious indicators without context. Even at this level, we have the potential to use our intel to develop detections, even if it’s just a simple detection for the presence of a value from the list. The major downside to using indicators from threat...