Integrating Threat Intelligence
Known-bad context, without the alert fatigue.
Key takeaways
- Never dump raw OSINT feeds into the SIEM — curate through a TIP (MISP, ThreatConnect) via STIX/TAXII.
- A dropped inbound from a bad IP is background noise; an allowed inbound or an internal host connecting out to a bad IP is the alert.
- Retire IP indicators after 14–30 days — IPs change hands fast.
- Retrospectively match new IoCs against the last 30–90 days of logs.
Detection engineering should map directly to the MITRE ATT&CK framework. Avoid simple threshold-based rules ("5 failed logins in 5 minutes") that generate high false-positive rates — focus on behavioral sequences, and treat rule writing like software development: detection as code.
Threat intel provides the "known bad" context, but it must be operationalized carefully to avoid alert fatigue. For tactical TI — IoCs like IPs, domains, and hashes:
- Curate, don't dump. Do not dump raw, uncurated OSINT feeds into your SIEM. Curate feeds using a Threat Intelligence Platform (TIP) like MISP or ThreatConnect, via STIX/TAXII.
- Alert on direction and outcome. A perimeter firewall dropping an inbound connection from a known-bad IP is normal internet background noise. Only trigger a high-severity alert if an inbound connection from a bad IP is allowed, or if an internal host initiates an outbound connection to a bad IP.
- Time-to-live (TTL). IP addresses change hands rapidly. Retire IP indicators after 14–30 days to prevent false positives.
- Retrospective matching. When a new IP or hash is added to your TIP, the SIEM should automatically query the last 30–90 days of logs to see if you were compromised before the IoC was widely known.
Keep reading — it's free
Register once to unlock every lesson in the Vijilan Cybersecurity Academy, track your progress, and earn domain badges toward the certification. No cost, no sales pitch.
- Every lesson, free
- Progress tracking
- Domain badges
- No credit card