After discussing some of the common techniques for detecting unknown potential threats, we are going to introduce some open source frameworks to do security analysis with threat intelligence and big data technologies. You may consider applying these open source solutions as a basis if you are planning to build a security log analysis framework that can do the following:
- Machine learning and correlation with the IoCs
- Analysis involving external threat intelligence feeds
- Data enrichment such as GeoIP information
- Visualization and querying of the relationships of IoCs
|
Project |
Key features |
|
TheHive project |
TheHive provides threat incident response case management that allows security analysts to flag IOCs. The Cortex can perform analysis with threat intelligence services such as VirtusTotal, MaxMind, and DomainTools. There... |