Blog

In mid-2010 I was running a large Defense contractor SOC and was forced to build what’s currently known as a threat intelligence platform (TIP).

Can you really “manage” threats? Is that even a worthwhile goal? And how do you define a threat?

Have you ever wanted to be alerted about new information related to the TTP of an adversary? Well now that’s possible!

In this post, we will look at “AutoFocus,” which gives access to Palo Alto’s Wildfire data and, when used with ThreatQ, allows you to more effectively and efficiently combat ransomware.

We have made significant changes to ThreatQ’s Recorded Future Custom Connector to support Recorded Future’s new API changes and additional risk lists.

During the time when we were designing the initial phases of our threat intelligence platform (TIP), we determined that there were some important core principles that should drive how we built the product.

The ThreatQ platform offers a two-step resolution through our new scoring feature. It starts by properly scoring intelligence for your environment, which I’ve discussed in detail in multiple blogs and in a new whitepaper.

You need a way to quickly re-score providers’ intelligence – aligning it to your own risk posture and prioritized based on threats specific to your environment – so you get the maximum benefit from threat intelligence.

Ransomware is still a major money maker for cyber criminals and victims are all over the board, ranging from individuals to major corporations.

Using the Exports section of ThreatQ, analysts are able to make data available to the team or tool that needs to consume the critical threat data using the Carbon Black integration.

There is no shortage of indicator data these days.  Large numbers of providers, both commercial and free, have set up shop to help fight the cause.

What happens when 2 Team Leads (w/ support from the rest of their immediate team) in a SOC “agree to disagree”? …they both compromise settling on middle ground.

ThreatQ Operations offers a tremendously powerful investigation and analysis capability to automate efforts across common workflows.