Cyware Threat
Intelligence eXchange (CTIX)
Features
Automated Intel Ingestion and Normalization
Automate threat intel ingestion and normalization from both internal tools and external sources and develop capabilities in proactively combating attacks in real-time.
Automated Internal Intel Ingestion
Gain a unique security posturing by ingesting internal Intel from multiple security tools deployed within your organization’s network including SIEMs, UEBA, Antivirus, IDS/IPS etc.
Automated External Intel Ingestion
Ingest Intel from multiple sources including TI providers, Regulators, Peer Organizations, ISACs, Dark Web, Partner Organizations, and your Subsidiaries.
Source and Collection Management
Subscribe to multiple sources, in multiple formats, and make a custom collection.
Format Agnostic
Automatically extract, normalize and ingest threat intel including IOCs in a plethora of structured and unstructured formats including (MISP, STIX 1.0, STIX 2.0, MAEC, Cybox, and email).
IOC conversion in Multiple Formats
Wide-ranging format support including STIX 2.0, MISP, XML, CSV, JSON, YARA, OpenIOC, ATT&CK, MAEC, IODEF and more.
Full Support for STIX 2.0
Full support for STIX 2.0 (JSON), as well as previous STIX versions 1.x (XML), to allow flexible correlation, analysis, and sharing.
Automated Intel Enrichment, Correlation, and Analysis
Go full throttle in streamlining intel ingestion, correlation, and analysis with a unique feature suite and facilitate quick analyst decision making when it comes to tackling threats in the operational environment.
IOC Confidence Scoring
Leverage policy-based automation to filter out irrelevant IOCs and focus on indicators that actually matter. Weighing in crucial threat parameters like TLP, geography, relation with malware etc to establish indicator confidence score in real-time while sharing within your network.
Machine Learning based Analysis
Automatically poll data sources and push analyzed data to other platforms, establishing a relationship between various attributes received in the intel with previously occurred incidents.
ATT&CK Navigator
Visualize APT threat actors’ Tactics, Techniques and Procedures (TTPs) using MITRE’s ATT&CK Navigator to identify trends and perform TTP correlation.
Threat Board
Search object types, indicator types and hidden cross-links between different attributes extracted from disparate threat intel.
Advanced Rule Engine
Automate mundane actions, speed up Triage Management and allow analysts to focus more on relevant tasks using the Advanced Rule Engine.
Indicator Deprecation
Reduce the burden on analysts by automating the graduated deprecation of irrelevant and inactive indicators.
Diverse Subscriber Authentication
Support multiple authentication methods including Basic, One/Two-way Certificate Authentication, and Blockchain-based authentication.
Duplicates Identification
Employ the power of artificial intelligence and machine learning for quick and efficient correlation of threat indicators, as well as the removal of duplicate IOCs.
IP and Domain Lookup
Integrate with services like WHOIS, VirusTotal, Shodan, Moz, and GeoIP, and empower your security analysts in accessing data collected from premium sources with a single click.
Fang-Defang
Neutralize malicious information with an obfuscated representation, so it is no longer dangerous if inadvertently clicked or automatically processed in error.
STIX 1.x to STIX 2.0 Conversion
Improve analysts’ maturity and interoperability with smooth and automatic conversion of STIX1.x (XML) to STIX 2.0 (JSON).
Geo-Tagging
Foster geographical mapping and analysis of threat intel automatically ingested from disparate sources. Identify geographical trends for your different business units and accordingly strategize mitigation and prevention.
Automated Intel Dissemination
Facilitate automated threat intel dissemination and develop a cyber-resilient ecosystem by minimizing third-party risks.
Automated Intel Dissemination to Internal Teams
Disseminate enriched Intel to multiple internal teams such as IR, SOC, Threat Hunting, Red Team, VAPT, Steering Community etc. for quick actioning and analysis.
Automated Intel Dissemination to External Entities
Enhance collaboration with multiple external entities such as ISACs, peers, subsidiaries, third-party vendors etc. by disseminating enriched intel for building a cyber-secure ecosystem.
Rule-Based Advanced Alerting and Notifications
Reduce Meantime to Detection and Resolution through real-time notification and multilevel alerting via Emails, SMS, and Calls.
Diverse Subscriber Authentication
Support multiple authentication methods including Basic, One/Two-way Certificate Authentication, and Blockchain-based authentication.
TLP: RED Auto Deletion
Equip users with Red TLP Auto Deletion to efficiently manage and secure the confidentiality of top secret/classified information by triggering automatic deletion.
Direct two-way sharing with the DHS AIS
Leverage secure certificate authentication to equip your threat response team with real-time updated and accurate threat intel information using direct two-way sharing of threat data with the US Department of Homeland Security (DHS) Automated Indicator Sharing (AIS).
Governance and Collaboration
Refine the entire procedure of governance by providing a centralized and unified view of the threat landscape.
Multi-level Intel View
Create a specialized Intelligence view for different roles within your organization including Analysts, SOC/IR Teams, Steering Committees, and CISO.
Analyst Watchlist
Leverage Watchlist feature to monitor relevant threats by automatically setting triggers for your organization or industry related keywords in intelligence feeds.
Centralized Threat Dashboard
View customized confidence scores, factor-based prioritization of cyber threats and detailed statistical metrics within a comprehensive platform.
Third-party collaboration
Automatically share real-time enriched and analyzed threat intel with your peer organizations, subsidiaries, third parties, regulators and ISACs.
Automated Intel Validation and Score Updation
Collaborate with your peers, affiliates, and subsidiaries for automated External and Internal Intel Validation and Scoring from multiple sources.
Automated Intel Actioning
Automate blocking of malicious IPs in Firewalls deployed in your organization on the basis of the IOC score and customized rules.
Resources
