13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes

13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes

A threat intelligence platform (TIP) is the Security Operations Center's catalog of objects the world — and your own incidents — have already labeled suspicious or confirmed malicious. This independent OpenExamPrep chapter covers SAL1 Threat Intelligence Platforms topics so a Level 1 (L1) analyst can ingest feeds, store indicators, and classify Internet Protocol (IP) addresses, domains, and file hashes without treating a red public score as a court verdict. The junior job is enrichment and honest confidence.

Keep the TIP distinct from the Security Information and Event Management (SIEM) system. The SIEM holds telemetry: firewall accepts, process creations, proxy requests. The TIP holds knowledge about objects that might appear in that telemetry. Confusing the two produces tickets that say "the SIEM says this IP is malware" when the SIEM only matched a lookup the TIP exported yesterday.

Platforms, feeds, and indicators

A feed is a stream of indicator records from a producer: an open blocklist, a commercial vendor, an Information Sharing and Analysis Center (ISAC), a government advisory, or your own incident-response exports. Feeds overlap. They go stale. A feed without an expiry date becomes a denial-of-service against your own analysts.

A TIP aggregates those feeds plus analyst-created indicators into one searchable object store. Typical jobs are deduplication, confidence scoring, tagging (malware family, campaign, infrastructure type), relating an IP to a domain to a hash, and exporting lists to the SIEM and to Security Orchestration, Automation, and Response (SOAR). Naming commercial products is unnecessary for SAL1; the skill is knowing what the platform does.

An indicator is a matchable artifact: this IPv4 or IPv6 address, this fully qualified domain or Uniform Resource Locator (URL), this SHA-256 of a file. SAL1-style L1 work stays at that object layer. Behavioural indicators of attack (IoAs) and the Pyramid of Pain are taught in the frameworks chapter; here the skill is classifying the three objects you will paste into a console.

Hash algorithms matter. MD5 and SHA-1 still appear in older tickets; SHA-256 is the current default for file identity. Two files with the same SHA-256 are the same bytes. Two files with different SHA-256 values are not the same sample, even if they behave similarly. If a ticket lists only MD5, say so, and ask detection engineering for SHA-256 when the file is still in EDR quarantine.

Tactical intelligence is this hash, this IP, this domain — the layer L1 touches every alert. Operational intelligence describes a campaign's infrastructure over days. Strategic intelligence describes who targets your sector. L1 tickets should not pretend a hash match is a strategic briefing.

Classifying IPs, domains, and hashes with common tools

Analysts commonly use public enrichment sites as a first look. VirusTotal aggregates many antivirus engines and sandbox reports against a hash, URL, or IP. AbuseIPDB collects community reports that an IP was used for scanning, brute force, or other abuse. Naming them here describes common SOC practice. It does not mean TryHackMe or OpenExamPrep recommends a vendor, and it does not make a public score into proof.

Classification is a structured opinion:

1. Identity. Is the string an IP, a domain, a URL, or a hash? Which hash algorithm? Copy-paste errors (an IPv6 truncated, a URL with a tracking suffix) create ghost indicators.
2. Ownership and sharing. Cloud provider, content delivery network, university NAT, residential ISP, or dedicated virtual private server? Shared infrastructure cannot be blocked as if it were a single attacker laptop.
3. Reputation history. How many sources, over what time window, for what behaviour? SSH brute-force reports from last year do not explain HTTPS beacons today.
4. Internal sightings. Has this object appeared on your hosts, and in what process or user context? The process tree beats a stale community list.
5. Freshness. When was the indicator first published, last confirmed, and when should it expire?

A useful verdict vocabulary is: known-malicious with high confidence, suspicious and needs more context, likely benign shared infrastructure, or insufficient data. Insufficient data is a legal L1 answer. It is not a failure.

Confidence is not alert severity. A TIP may mark an IP as high-confidence scanner. A SIEM may still attach High severity if that IP later appears in a ransomware process tree. Read both fields. Do not paste a TIP confidence number into the ticket as if it were business impact.

The cyber threat intelligence lifecycle at Level 1

Cyber threat intelligence (CTI) still follows a classic intelligence cycle. L1 mostly executes the middle stages, but you should be able to name all five.

Direction. Leadership and detection engineering decide the questions: which malware families matter, which partner IP ranges must never auto-block, which hash lists are allowed into production watchlists. Direction is the requirement. Without it, every feed looks equally important.

Collection. Pull commercial feeds, open lists, phishing-mailbox attachments, EDR quarantines, and hashes from yesterday's true positives. Collection includes your telemetry — a hash that detonated on one laptop is an internal collection event, not only a vendor JSON blob.

Processing. Normalize formats, drop duplicates, store SHA-256 when known, apply tags, set time-to-live (TTL). Processing is why a TIP exists. Raw pastes into a firewall are not processing. Industry sharing often uses structured bundles (you may hear STIX and TAXII as common packaging and transport). You do not need to author those formats at L1; you need to know that a dump of unlabelled IPs in a chat window has not been processed.

Analysis. A human — or a carefully scored playbook a human still reviews — adds meaning: this IP is documented command-and-control and it currently sits on a cloud range a SaaS product uses. Analysis is where single-source reputation gets challenged.

Dissemination. Push the indicator to SIEM lookups, SOAR enrichment, EDR hash lists, DNS sinkholes, and the case notes other analysts will read at 03:00. Dissemination without context ("block this") creates outages. Dissemination with expiry and source ("watch 14 days; source incident 1842") is how a SOC stays sane.

L1 analysts rarely set Direction. They do Collection when they harvest hashes from an alert, Processing when they paste into the TIP instead of a personal spreadsheet, Analysis when they refuse to treat one engine as gospel, and Dissemination when they write the indicator into the ticket with a recommended action.

Worked example: enrich an alert IP before blocking

Alert. SIEM notable: host WKST-FIN-14 made HTTPS connections to 203.0.113.88 on port 443, forty times in twenty minutes. A junior instinct is a perimeter block.

Do not block yet. Walk the enrichment path.

1. Internal context first. Asset lookup: finance Windows 10 laptop, user j.patel, EDR installed. Process tree from EDR (not from the TIP): chrome.exe is the parent; the server name indication looks like a content host. Forty connections in twenty minutes can be a page with many assets — or a beacon. You do not know yet.
2. TIP query. Search 203.0.113.88. Three feed hits: two community scanner lists from eleven months ago tagged "SSH brute force," and one commercial feed from last week tagged "malware C2" with medium confidence. Conflicting tags are normal.
3. Common public tools. VirusTotal shows 4 of 94 detections on the IP, all generic "malicious site" heuristics, with no file communicating with it in the last 24 hours. AbuseIPDB shows a low report count, mostly from a single reporter, category SSH. Port 443 web traffic does not match those old SSH reports.
4. Sharing and ownership. The IP belongs to a regional cloud provider. Neighbouring addresses host unrelated tenants. Blocking the single host might be acceptable after more evidence; blocking the whole prefix would take down customers you have never seen.
5. Decision. Do not push a firewall block from L1 on this evidence. Document: cloud shared IP, stale SSH reports, weak VirusTotal ratio, process is the browser. Escalate if EDR shows a non-browser process, if a downloaded file hash is known-bad, or if other hosts beacon on a fixed interval. Optional: add a time-bounded SIEM watch for that IP plus non-browser processes.

The teaching sequence is alert → identity → internal context → TIP and public classification → sharing and ownership → action with expiry. Blocking is an action at the end, not a reflex at the start.

Trap: a single VirusTotal detection is not proof

VirusTotal's value is breadth. Its trap is the red number.

One engine out of dozens flagging a hash is often a generic heuristic, packed-file suspicion, or a noisy name. Community comments get copied from older samples. An IP "detected" because a scanner once saw a phishing kit on a neighbouring tenant is not your incident. Conversely, zero detections on a two-hour-old hash is also not proof of clean — new commodity malware is often unknown to aggregators until it spreads.

Use VirusTotal and AbuseIPDB as inputs to Analysis, not as Dissemination. Record the ratio, the date of last scan, whether engine names are specific families, and what your own process tree showed. If you cite a public tool in a case, cite the observation ("4 of 94, generic, no sandbox detonation") rather than the feeling ("VirusTotal says bad").

The same trap in reverse: an IP with a high AbuseIPDB score that is also your cloud provider's NAT will generate reports from the entire internet. Blocking it will look like decisive CTI and will break payroll.

Do not upload unique internal samples or unpublished hostnames to a public classifier if policy forbids it. Public submission can leak that you were hit and can burn a detection. Use the organisation's approved private API or TIP integration.

Operational habits

Stamp every indicator with source, first-seen, last-seen, confidence, and expiry. Prefer SHA-256. When feeds conflict, the internal process tree wins over a stale community list. Never treat TIP presence alone as containment authority — that decision still needs asset context, which the next section takes into SIEM and SOAR.