Creating threat intelligence data out of threat information

Creating threat intelligence data out of threat information is the cornerstone activity of threat intelligence efforts. It is also the most challenging part of the process. A good approach is to start by eliminating threat information that is not relevant to your environment. As an example, if you do not have Siemens equipment, delete any threat information that you pulled in from your threat information sources that is related to Siemens, or add a relevance attribute to your threat information and assign a low score to any Siemens-related information. On the opposite side, for equipment brands and vendors you do use, add a higher relevance scoring, tied to the criticality of the equipment.

The next step in the threat intelligence creation process would be to start adding additional data, that is, additional attributes to the threat information that is most relevant to you. Add information such as WHOIS data, DNS and reverse...