Prescriptive Adoption Motion - Threat intelligence

Aim and strategy

Splunk customers who are able to advance and mature their threat intelligence capabilities are more likely to detect and respond to credible threats, and have more insights into the threats that bubble up. Contextual information derived from threat intelligence can help SOC teams make more actionable, timely and appropriate decisions, and even helps teams identify threats proactively before they are known.

Threat intelligence management performs three basic functions:

• Aggregation. Brings multiple threat intelligence data feeds into a centralized feed or repository.
• Analysis. Curates data, using indicators of compromise to define and identify security threats.
• Action. Disseminates relevant threat intelligence with incident response and defense teams for defensive posture adjustments or incident response activities.

Each of these functions plays a role in the security lifecycle of information as it is collected, assessed, disseminated, and actioned. The following steps provide a detailed breakdown of the components involved in the threat intelligence security lifecycle:

1. Collection. Identify data that provides value and relevance to your organization, with intelligence related to industry, geography, or a specific type of threat, such as malware. Ingest and aggregate data from multiple threat feeds, for example CSV, STIX, XML, JSON, OpenIOC, or raw data formats. Data should be included from internal sources such as network activity events, and from external sources such as public feeds and the dark web.
2. Correlation. Where possible use automated processes, such as a Threat Intelligence Platform (TIP) to sort the data, organize it with metadata tags, and remove non-relevant or redundant information. Then compare the data with previously curated information, searching and finding patterns or correlations to detect threats.
3. Contextualization or enrichment. Context is key in threat intelligence. Without it, analysts may easily confuse an anomaly with a threat while overlooking the real threats. Enrichment provides context to data to help eliminate false positives or connect a relationship. Adding data such as IP location, network information, and blocklists provides teams with as much detailed information about the potential threat as possible.
4. Threat analysis. Processing and enriching intelligence-based threat indicators in real-time allows analysts to see the relationship between data events. Security analysts can use this information to detect hidden threats and proactively hunt out unknown risks.
5. Integration. Contextualized threat intelligence can now be integrated with security tools, such as Splunk Enterprise Security, Splunk SOAR, and Splunk Mission Control to maximize information correlation and investigation.
6. Action. Use threat intelligence integration in the processes that aid in automated responses. When events are actioned in Splunk SOAR or Splunk Mission Control, the automated analysis of event data helps facilitate collaboration with internal and response teams, and shortens the response time (MTTR) in the event of an active cyber attack.

This lifecycle continually operates and improves as the program matures to help achieve the goal of collection and contextualization of data in a team's effort to perform informed risk based threat detection, mitigation, analysis, and response.

Common use cases

• Incident enrichment and contextualization of security event data
• Vulnerability assessment and prioritization
• Creating a threat intelligence-led incident response plan
• Threat hunting and proactive defense
• Threat modeling

User roles

Preparation

Starting to build a threat intelligence strategy can often be challenging due to the dynamic nature of cyber threats. Organizations must be able to rapidly adapt to the evolving threat landscape and changing risk posture of their strategy. The threat intelligence lifecycle is the framework that helps teams plan and execute their project, optimize resources, and respond to threats.

Implementation guide

Integration of Splunk Enterprise Security with threat intelligence data or information accessible via a threat intelligence platform can assist in prioritizing alerts, adding value to Splunk Enterprise Security and to the entire response process.

Splunk Enterprise Security, like many SIEM platforms, has built-in threat intelligence management capabilities that can enhance the accuracy and effectiveness of your defense. Some of the key features present in Splunk Enterprise Security include:

• Integrated threat lists. 30+ intelligence feeds and frameworks that can be enabled for use to provide additional contextual information and detections.
• Behavior analytics. Splunk Cloud Platform leverages behavioral analytics to detect behavior anomalies that may result in an attack. It correlates the data, giving it context, effectively identifying if the threat is real, and determining its level of severity.
• Notable integration with Splunk SOAR. Use Splunk SOAR to automate the collection of data and response to low-level security events. Splunk SOAR identifies events of interest, compares them with existing threat intelligence data, and follows up with mitigation activities. With automation in place, analysts have more time to focus on high-level, complex threats.

Threat intelligence feeds support early incident detection by helping teams classify high-risk activities and security incidents. They also help guide the response efforts associated with investigating and remediation. This information is especially useful when integrated into an automated incident response pipeline because it helps predict the course of an attack.

As an Splunk Enterprise Security administrator, you can correlate indicators of suspicious activity, known threats, or potential threats with your events by adding threat intelligence to your deployment. Adding threat intelligence enhances your analysts' security monitoring capabilities and adds context to their investigations.

Enabling threat intelligence with Splunk Enterprise Security is a simple process:

1. Using threat intelligence in Splunk Enterprise Security
2. Add threat intelligence to Splunk Enterprise Security
3. Expand Splunk Enterprise Security threat intelligence coverage with apps from Splunkbase

You can check these guides to see how to use threat Intelligence with Splunk SOAR and Splunk Mission Control:

• Enrich incidents in Splunk Mission Control with intelligence sources
• Configure intelligence workflows for Splunk Mission Control to automate indicator processing
• Expand Splunk SOAR threat intelligence coverage with apps from Splunkbase

Success measurement

When implementing this guidance, you should see improvements in the following:

• Input
  • How many alerts were enhanced with intelligence?
  • How many feeds are being ingested?
• Analysis
  • Number of new external campaigns/threat groups tracked.
  • Vulnerabilities that are being tracked.
  • Number of techniques, tactics, and procedures (TTPs) detections added to SOC workflow (for example Yara, IDS sigs).
  • Number of indicators of compromise (IOCs) for detections or mitigations added to SOC workflow (IP addresses, domains, file hashes).
  • Feed efficacy (new data added, old data expired, uniqueness of data).
• Output
  • Curated intelligence published (daily, weekly, quarterly, flashes).
  • How many threat intelligence projects were successfully completed?
  • Number of stakeholder interactions influenced by threat intelligence (for example security architecture, physical security).
  • Due diligence - how often did you check specific feeds with auditable results?
  • How many failures to correctly anticipate events were there?
  • How many analysis judgments were made, but proven later to be incorrect?
  • Number of stakeholders that provided threat intelligence relevant to needs.
• Impact
  • Percentile finds directly attributable from threat intelligence - what sources, and what source found what.
  • Incident response tickets directly attributable to intelligence.
  • Instances where threat intelligence has led to re-prioritization (for example, urgent patching, new architectural direction).
  • Number of campaigns/threat groups identified directly targeting the organization.
  • Timeliness of notification versus patching.
  • Timeliness of intelligence versus event.