Automated Threat Intelligence Enrichment
So Many Indicators...
Threat intelligence enrichment is a critical component of any incident or threat investigation process. The enrichment process helps remove false-positives and deduce actionable intelligence for threat response and other security operations. Until now, the process has largely been manual with security analysts sifting through several trusted sources and enriching any potential threat indicator manually. The process is cumbersome, takes up a lot of time, and is impractical in the present cyber threat landscape where hundreds if not thousands of indicators are collected on a daily basis. However, with Cyware’s automated threat intelligence enrichment, the entire enrichment process can be performed within seconds along with high-level threat data analysis.
One Playbook to Enrich Them All
With the threat intelligence enrichment playbook, potential threat indicators will automatically be enriched with more details and context to improve incident investigation with Cyware’s Respond and Orchestrate platform. The playbook will be triggered for any indicator of compromise (IOC) observation during an incident investigation.
The threat intelligence enrichment playbook performs the following tasks:
Indicator Ingestion
The playbook automatically ingests and normalizes indicators from external and internal threat intelligence.
Extraction and Enrichment
The playbook enriches the collected IOCs from several internal and external trusted intel sources and the final Risk Score is calculated. Following actions help to prioritize the actioning on relevant intel:
- The threat intelligence is filtered based on a customizable confidence score mechanism (Cyware Confidence Score) which is calculated from various factors that include threat sightings, TLP, Source of intelligence, and more.
- The indicator reputation scores are collected across several trusted intel enrichment sources.
- Automated correlation with Threat Intel Watchlist of SIEM solution.
- Contextual information about the IOCs and their relevance with other malware, threat campaigns, or indicators is collected.
Indicator Scoring
Following the enrichment process, the defined custom logic in playbooks can automatically score the intel and help prioritize the next course of action in your incident response.
Analysis and Action Taking
Based on the triaging information several incident response actions can be triggered:
- Blocking of indicators on Firewall, EDR, etc as a preventive measure.
- Adding the indicator to the watchlist of the SIEM solution.
Cyware Advantage
Automate Repeatable Tasks
With the automated process of sifting relevant IOCs, analysts save significant time that can be better spent on in-depth analysis and strategic action against threat actors.
Actionable Threat Intelligence
With the automated enrichment and scoring of indicators based on contextual factors, the playbook provides actionable intel for security analysts to work upon.
Better Response Workflow
The automated playbook provides SOC analysts with a comprehensive view of the response workflow, equipping them with correlation intelligence for informed decision-making.
The Virtual Cyber Fusion Suite
