Threat intelligence enrichment

What are the benefits of effective threat intelligence enrichment?

In a military, business, or security context, intelligence is information that provides an organization with decision support and possibly a strategic advantage. Threat intelligence is a part of a bigger security intelligence strategy. It includes information related to protecting your organization from external and inside threats, as well as the processes, policies, and tools used to gather and analyze that information.

Threat intelligence provides better insight into the threat landscape and threat actors, along with their latest tactics, techniques, and procedures. It allows you to be proactive in configuring your security controls to detect and prevent advanced attacks and zero-day threats. Many of these adjustments can be automated so that security stays aligned with the latest intelligence in real-time, and integrated threat intelligence helps you stay ahead of advanced threats.

What are threat intelligence enrichment best practices?

1. Select the right sources of threat data for your organization.
   Not all threat intelligence is equal - threat intelligence that is of value to one organization may not be of value to another. Value comes down to relevance and accessibility, which requires curation into a customized enrichment source, aggregating data filtered by a range of factors. Those factors could include industry, geography, your organization's environment and infrastructure, the third parties your organization works with, your organization's risk profile, and more.
2. Determine who will acquire the data.
   While it may be ideal to provide access to threat data to a broad audience, it is probably better to have one team responsible for acquiring and analyzing threat intelligence and only delivering actionable information. Not every stakeholder needs every level of intelligence, so think about how the same report will impact and be used by various teams across the organization. Different teams may use different aspects of the same report in different ways to achieve their desired outcomes, for example modifying strategic policy, launching operational hunting campaigns, or disseminating tactical technical indicators.
3. Structure the data for analysis.
   Threat data comes in a multitude of formats that need to be normalized. These sources can be as diverse as STIX, MITRE ATT&CK techniques, news articles, blogs, tweets, security industry reports, indicators of compromise (IoCs) from threat feeds, GitHub repositories, Yara rules, Snort signatures and more. In addition, the volume of information across the threat intelligence landscape is high and different groups use different names to refer to the same thing. Normalization compensates for this and enables teams to aggregate and organize information quickly.
4. Use tools to help with analysis.
   Effective analysis can be quite a challenge, particularly during a big event. Splunk Enterprise Security does a good job of extracting context and can help your teams use information in various ways for different use cases and to support different outcomes - for example, alert triage, threat hunting, spear phishing, incident response, and more. The Splunk Enterprise Security Threat Intelligence framework helps aggregate, prioritize, and manage a wide variety of threat intelligence feeds.

What threat intelligence enrichment processes can I put in place?

These resources might help you understand and implement this guidance:

• Product Tip: Using Threat Intelligence Management
• Getting Started Guide: Using Threat Intelligence Management