As discussed earlier, the process of intelligence gathering can be automated either with the help of different scripts that we can combine, or to have a central platform in place capable for both collecting and sharing cyber threat intelligence. Central platforms that have this capability are called cyber threat intelligence platforms. Let's try to understand the process of semi-automation and complete automation of cyber threat intelligence gathering:
- The following diagram represents the problem statement that a threat intelligence platform tries to solve. In a large organization, the SIEM tool generates 100–100,000 events per minute, and the rule engine triggers 20–50 alerts in an hour. The analyst needs to validate each alert manually and check if the IP or domain in question is legitimate or not. The analyst has to use...