Analysis
The analysis stage of the intelligence life cycle is where any threat activity is analyzed. Once the data has been centralized in a standardized way, the byproduct can be analyzed and curated. For example, the analysis stage includes deduplication, admiralty scoring, pivots, and enrichment to be actionable to departments across the organization, such as the SOC or incident response. During this stage, the bulk of the analysis goes into threat intelligence generation.
To understand the analysis phase of the intelligence life cycle, let's examine an in-depth case study from start to finish using freely available tools. While there are many scenarios where threat intelligence can be used during SOC-identified incidents, this example will focus on only one possible outcome.
For this example, let's act as though the SOC within Ozark International Bank has identified a suspicious file on an endpoint. The file, named $77-Venom.exe, has a SHA256 hash of 5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f548...
