Threat Intelligence
Threat Intelligence (TI) fetches information and insights about existing or potential cyber threats and risks from various sources. It then assembles, processes, and analyzes the fetched information and uses it to predict data breaches, vulnerable attacks, and any evidence of pre-planned attacks or threats, and notifies about it in real-time. You can also link custom threat data sources and fetch and analyze their logs.
Package Details
Threat Intelligence Components:
-
Enrichment Source
- ThreatIntelligence
-
Process Command
- ti
-
Dashboard Package
- LP_Threat Intelligence
-
Alert Packages
- LP_Threat Intel Internal Machine Connecting to Multiple IOCs
- LP_Threat Intel Excessive Denied Connections Attempt from IOC
- LP_Threat Intel Connections with Suspicious Domains
- LP_Threat Intel Allowed Connections from Suspicious Sources
- LP_Threat Intel IOC Connecting to Multiple Internal Machines
Enhancement
For threat intelligence ingested from MISP, the score field values is set to 1 by default when MISP does not provide a risk score, ensuring consistent results in searches, dashboards, and correlation rules.
Bug Fix
Non-admin users were unable to view plugins, under Configurations >> Enrichment Sources, including threat Intelligence even when assigned to permission groups that previously allowed this access.
Past Releases
Threat Intelligence v6.4.2▾
Bug Fixes
Threat Intelligence v6.4.1▾
Enhancement
Updated packages to address identified vulnerabilities.
Threat Intelligence v6.4.0▾
Enhancement
The following columns are added to the threat intelligence table:
- Confidence: indicates reliability, helping prioritize high-confidence threats for quicker action while reducing false positives.
- ASN: provides insight into the source, enabling more accurate threat attribution and proactive defense measures.
- Tag: facilitates threat categorization, allowing for better organization, filtering, and retrieval of relevant threat data during investigations.
Threat Intelligence v6.3.1▾
Bug Fix
Threat Intelligence v6.3.0▾
Enhancement
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.