7.2 Threat Intelligence Sources, Formats, and Platforms

Cyber Threat Intelligence Sources

A resilient Threat Intelligence capability relies on a multi-layered collection strategy. Ingesting telemetry from multiple distinct source categories ensures balanced coverage across commodity malware, opportunistic scanning, targeted sector campaigns, and advanced zero-day exploits.

1. Internal Telemetry Sources

Internal telemetry constitutes the most relevant and high-fidelity intelligence an organization possesses. Because it reflects activity directly targeting or existing within enterprise boundaries, its false-positive rate is negligible:

• Host and Endpoint Telemetry: EDR process execution trees, Sysmon event streams (e.g., Event ID 1 for process creation, Event ID 10 for process access), PowerShell Script Block logs (Event ID 4104), and local authentication logs.
• Network Perimeter & Flow Telemetry: Firewall connection state tables, Web Application Firewall (WAF) inspection logs, proxy access logs, DNS resolver query/response logs, and Zeek/Bro network protocol logs (conn.log, dns.log, ssl.log).
• Deception Technologies: Internal network honeypots, fake Active Directory administrative accounts (honeytokens), and dead-end network shares designed to trigger instant, high-fidelity alerts when probed.
• Historical Incident Forensics: Artifacts harvested from previous containment and post-incident reviews (PIRs) within the enterprise.

2. Open-Source Intelligence (OSINT)

OSINT consists of publicly accessible information harvested without specialized credentials:

• Vulnerability Databases: National Vulnerability Database (NVD), Common Vulnerabilities and Exposures (CVE), and Exploit-DB.
• Code Repositories: Public GitHub/GitLab commits, Gists, and Pastebin, monitored for leaked corporate API keys, compromised source code, and proof-of-concept (PoC) exploit scripts.
• Security Research Publications: Threat research bulletins published by cybersecurity vendors, academic papers, and social media feeds (e.g., Mastodon, X infosec communities).
• Operational Limitation: OSINT provides massive volume but exhibits an unfavorable signal-to-noise ratio, demanding extensive automated parsing, deduplication, and verification.

3. Commercial Intelligence Feeds

Commercial providers (e.g., Mandiant Advantage, Recorded Future, CrowdStrike Falcon X, Group-IB) deploy dedicated global sensor grids, sinkholes, human intelligence (HUMINT) operatives infiltrating dark web forums, and reverse-engineering labs:

• Deliver curated, high-confidence actor profiles, infrastructure attribution, campaign timelines, and validated indicator feeds.
• Supply turnkey machine-readable feeds (MRTI) for direct ingestion into enterprise SIEM, TIP, and SOAR tools via RESTful APIs.

4. Information Sharing and Analysis Centers (ISACs)

ISACs are non-profit, member-driven organizations designed to facilitate trusted cross-enterprise threat sharing within critical infrastructure verticals:

• Financial Services ISAC (FS-ISAC): Banking, investment firms, and payment processors.
• Health-ISAC (H-ISAC): Hospital networks, pharmaceutical research, and medical device manufacturers.
• Automotive ISAC (Auto-ISAC): Vehicle manufacturers and connected mobility providers.
• Multi-State ISAC (MS-ISAC): U.S. state, local, tribal, and territorial governments.
• Value: Allows peer institutions facing identical regulatory frameworks and adversary groups to share anonymized attack telemetry under TLP boundaries.

5. Government Sharing Programs

• CISA Automated Indicator Sharing (AIS): A Department of Homeland Security / CISA capability enabling bidirectional machine-to-machine exchange of cyber threat indicators between federal agencies and private commercial partners at machine speed via STIX/TAXII.
• CISA Known Exploited Vulnerabilities (KEV) Catalog: An authoritative list of CVEs verified as actively exploited in the wild, establishing mandatory patching timetables for federal agencies and best practices for enterprise SOCs.

---

Standardized CTI Formats: STIX, TAXII, and OpenIOC

Standardized formats eliminate vendor lock-in and enable seamless interoperability between threat providers, TIPs, SIEMs, and perimeter firewalls.

STIX (Structured Threat Information Expression) 2.1

Maintained by the OASIS Open consortium, STIX 2.1 is a graph-based data model serialized exclusively in JSON. STIX 2.1 models cybersecurity knowledge through interconnected nodes and edges:

• STIX Domain Objects (SDOs): The core entities representing knowledge concepts. Primary SDOs include:
  • indicator: Detects a cyber observable pattern using STIX Patterning.
  • malware: Identifies a malicious software program or family.
  • threat-actor: Identifies an individual, group, or nation-state adversary.
  • attack-pattern: Represents a specific TTP, typically referencing MITRE ATT&CK.
  • identity: Details target victims, organizations, or individuals.
  • vulnerability: Identifies an exploitable flaw (CVE).
  • campaign: A grouping of malicious activities over a specified timeframe.
  • infrastructure: Command-and-control servers, botnets, or hosting networks.
• STIX Relationship Objects (SROs): Edges connecting SDOs to form a semantic knowledge graph:
  • relationship: Expresses directional semantic links (e.g., indicates, uses, targets, attributed-to, mitigates).
  • sighting: Expresses that an indicator was observed on an enterprise network at a specific time.

{
  "type": "bundle",
  "id": "bundle--c1b99a6a-8451-40be-9097-7e61a6681023",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
      "created": "2026-09-01T08:00:00.000Z",
      "modified": "2026-09-01T08:00:00.000Z",
      "name": "Cobalt Strike C2 Beacon IPv4 Pattern",
      "pattern": "[ipv4-addr:value = '198.51.100.77']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T08:00:00Z"
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a7810e2-6324-4f86-9a22-386f7bcf9df1",
      "created": "2026-09-01T08:00:00.000Z",
      "modified": "2026-09-01T08:00:00.000Z",
      "name": "Cobalt Strike",
      "is_family": true
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b467ec21-a3f8-48b9-9cf3-8f0a1c32490b",
      "created": "2026-09-01T08:00:00.000Z",
      "modified": "2026-09-01T08:00:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
      "target_ref": "malware--4a7810e2-6324-4f86-9a22-386f7bcf9df1"
    }
  ]
}

TAXII (Trusted Automated eXchange of Intelligence Information) 2.1

While STIX defines what is shared, TAXII 2.1 defines how it is transported. TAXII is an application-layer client-server protocol operating over HTTPS REST APIs with content negotiation header application/taxii+json;version=2.1:

• TAXII Server Concepts:
  • Discovery Endpoint (/taxii2/): Advertises available API roots and authentication mechanisms.
  • Collections: Logical repositories of STIX objects hosted on a TAXII server. Clients poll Collections via HTTP GET requests (filtering by timestamp or object type) and upload intelligence via HTTP POST requests.
  • Channels: Publish-subscribe message brokers allowing real-time push streaming of threat intelligence to subscribed clients.

Legacy & Alternative Formats

• OpenIOC: An XML-based format developed by Mandiant for recording technical indicators (file paths, registry keys, hashes) used primarily by host-based endpoint forensics tools. Largely superseded by STIX 2.x.
• CybOX (Cyber Observable eXpression): An earlier OASIS XML standard for representing measurable events and stateful properties (e.g., registry entries, HTTP headers). In STIX 2.x, CybOX was directly integrated as native STIX Cyber Observables (SCOs).

CTI Sharing Standards Comparison Table

---

Threat Intelligence Platforms (TIPs)

A Threat Intelligence Platform (TIP) is the centralized management hub that aggregates, normalizes, scores, enriches, and disseminates threat data across the enterprise security ecosystem. Without a TIP, SOCs become overwhelmed by uncoordinated feeds.

[TIP Operational Pipeline]
Feed Ingestion ──► Normalization ──► Deduplication ──► Enrichment ──► Scoring & Decay ──► Syndication
(Commercial,       (JSON STIX 2.1,  (MD5/SHA256,       (VirusTotal,    (Confidence        (SIEM, Firewalls,
 OSINT, ISAC)       TAXII Poll)      IP De-dupe)        Passive DNS)    Decay Curves)      EDR, SOAR)

Core TIP Capabilities

1. Multi-Feed Aggregation: Ingests hundreds of heterogeneous feeds across OSINT, commercial vendors, and ISAC TAXII servers.
2. Normalization & Deduplication: Converts disparate schemas into STIX 2.1; merges identical IP or hash observables into a single record.
3. Automated Enrichment: Queries external passive DNS, WHOIS registries, and reputation APIs to augment incoming indicators with contextual metadata.
4. Confidence Scoring & Aging: Calculates dynamic confidence ratings (0-100) and applies indicator decay formulas to automatically de-list stale IoCs.
5. Bidirectional Syndication: Exports curated, high-confidence threat packages directly to SIEM lookup tables, firewall dynamic blocklists, and EDR blacklists.

Threat Intelligence Platform (TIP) vs. SIEM Architecture

In a modern Security Operations Center, a critical architectural distinction exists between a Threat Intelligence Platform (TIP) and a Security Information and Event Management (SIEM) system. While both systems manage security data, they fulfill fundamentally different, complementary missions:

Open-Source vs. Commercial TIPs

• MISP (Malware Information Sharing Platform): Widely adopted open-source platform. Organizes threat data into Events containing technical Attributes. Supports Taxonomies (e.g., TLP, Admirality Code) and Galaxies (threat actor clusters, ATT&CK matrices). Excels at peer-to-peer synchronization between trusted partner organizations.
• OpenCTI: Modern, open-source CTI platform developed by Luatix. Built natively on the STIX 2.1 graph data model with a GraphQL API, RabbitMQ message brokers, and Elasticsearch storage. Provides rich visual knowledge graphs linking threat actors, malware, vulnerabilities, and targeted sectors.
• Commercial TIPs (ThreatConnect, Anomali ThreatStream): Offer turnkey enterprise integrations, dedicated customer support, built-in SOAR automation playbooks, and high-performance in-memory processing for multi-terabyte threat data stores.

---

External Enrichment APIs in SOC Alert Triage

When a Tier 1 or Tier 2 analyst investigates an alert in the SIEM, external enrichment APIs provide immediate external context, enabling the analyst to validate alerts within seconds:

• VirusTotal: Aggregates over 70 antivirus engines, dynamic sandbox execution reports (Cuckoo, CAPE), and static PE file metadata. Analysts query file hashes to inspect detection ratios, behavioral network connections, and spawned processes.
• AlienVault OTX (Open Threat Exchange): Crowdsourced repository of community-contributed "Pulses" grouping related indicators by campaign. Provides passive DNS mappings and historical domain resolution records.
• Shodan: Internet-wide port scanning search engine. Analysts submit suspicious public IPs to inspect open ports, exposed services, software banner strings, and SSL/TLS certificate fingerprints (JA3/JA3S hashes).
• GreyNoise: Analyzes mass internet background traffic. Categorizes IPs into benign internet scanners (e.g., Shodan, Censys, university research crawlers) versus malicious opportunistic scanners. A GreyNoise classification can help explain commodity scanning, but the analyst should validate the classification, asset exposure, observed action, and local context before suppressing or closing an alert.
• AbuseIPDB: Crowdsourced repository documenting IP addresses reported for malicious behavior (SSH brute-force, web application probing, spam). Returns an Abuse Confidence Score (0% to 100%) based on the volume and recency of verified community reports.