Evaluating a security operations strategy for sharing technical threat intelligence
Security operations is a continuously evolving aspect of a company. This involves the need to stay a step or two ahead of the constant addition of new and more complex attacks, and the always-present attacks, such as phishing, malicious URLs, and brute-force attacks. Constant learning and sharing of technical threat intelligence is necessary for effective security operations.
Threat intelligence gathers data on a potential attack that assists in defining the scope and objective of the threat. This is defined in the alert with characteristics of the attack, the potential location latitude and IP address of the attack, and the resource that is the destination of the attack. Refer to Figure 3.1 to see how threat intel plays a role in the SOF tiers.
Microsoft Sentinel utilizes Microsoft’s network of global threat intelligence professionals and partners. This threat intelligence is essential...