Threat Intelligence
StandardThreat Intelligence (TI) fetches information and insights about existing or potential cyber threats and risks from various sources. It then assembles, processes, and analyzes the fetched information and uses it to predict data breaches, vulnerable attacks, and any evidence of pre-planned attacks or threats, and notifies about it in real-time. You can also link custom threat data sources and fetch and analyze their logs.
Package Details
Threat Intelligence Components:
- Enrichment Source
- ThreatIntelligence
- Process Command
- ti
- Dashboard Package
- LP_Threat Intelligence
- Alert Packages
- LP_Threat Intel Internal Machine Connecting to Multiple IOCs
- LP_Threat Intel Excessive Denied Connections Attempt from IOC
- LP_Threat Intel Connections with Suspicious Domains
- LP_Threat Intel Allowed Connections from Suspicious Sources
- LP_Threat Intel IOC Connecting to Multiple Internal Machines
Bug Fix
process ti and process lookup queries failed. If any alert rule used process lookup, all alert rules could stop generating incidents.
Past Releases
Threat Intelligence v6.4.4 ▾
Bug Fixes
Creating a MISP configuration for a free feed without an API key failed with the error cannot access local variable 'encrypted_api_key' .
MISP feeds that require an API key stayed in the pending state after upgrading to version 6.4.3 and did not ingest any data.
A fresh installation of version 6.4.3 did not include the Threat Intelligence analytics package, so the LP_Threatalert rules and vendor dashboards were missing.
For MISP feeds, start_ts and end_ts (misp_start_ts and misp_end_ts) were always set to the ingestion time, so every indicator showed the same start and end time regardless of its age. These fields now use the attribute's first_seen and last_seen values and are left empty when the feed does not provide them.
Important:
We have identified an issue in v6.4.4 that can prevent incidents from being generated on SIEM instances. We recommend that you skip v6.4.4 and install v6.4.5, which resolves this issue.If you have already installed v6.4.4, upgrade to v6.4.5 and create a support ticket so we can check whether your instances are affected.
Threat Intelligence v6.4.3 ▾
Enhancement
For threat intelligence ingested from MISP, the score field values is set to 1 by default when MISP does not provide a risk score, ensuring consistent results in searches, dashboards, and correlation rules.
Bug Fix
Non-admin users were unable to view plugins, under Configurations >> Enrichment Sources, including threat Intelligence even when assigned to permission groups that previously allowed this access.
Threat Intelligence v6.4.2 ▾
Bug Fixes
Threat Intelligence v6.4.1 ▾
Enhancement
Updated packages to address identified vulnerabilities.
Threat Intelligence v6.4.0 ▾
Enhancement
The following columns are added to the threat intelligence table:
- Confidence: indicates reliability, helping prioritize high-confidence threats for quicker action while reducing false positives.- ASN: provides insight into the source, enabling more accurate threat attribution and proactive defense measures.
- Tag: facilitates threat categorization, allowing for better organization, filtering, and retrieval of relevant threat data during investigations.
Comments
Article is closed for comments.