The purpose of threat intelligence is to help an organization to prepare for known and unknown threats. To address the unknown threats, the external threat feeds can be used to identify whether the existing environment may have similar threats, and also be used to optimize the security detection rules. For example, a known cybercrime IP or the Tor exit IP can be used to block the outbound connection IP lists in the firewall.
Integrate the internal threat log information, and the external threat feeds will help to combine the known and unknown threats and take proactive steps. The whole threat intelligence process normally includes the following key components:
- The log collector: This is used to collect the internal system, applications, and security logs
- SIEM/visualization: This is used to visualize the security posture in one dashboard
- Threat intelligence...