Defining the right sources for threat intelligence

Selecting the data source is part of the data collection phase of CTI. Hence, it is a crucial step in using intelligence for security enhancement. Organizations that possess a basic security defense system manage to collect network traffic, logs, and any other activities that happen in the system. This data is a good source of intelligence. However, most companies look at external sources to enrich the Threat Intelligence Platform (TIP) or SIEM to produce reliable threat intelligence results. There are two main categories of threat data sources: internal and external. Let's discuss the difference between the two.

Internal threat intelligence sources

Internal sources include all data coming from within internal systems. These sources include network logs (network element logs such as firewalls, IDSes, IPSes, proxy servers, application servers, and more), user logs, application logs, internal malware analysis, historical cyber...