Blog

We’re excited to announce version 3.1 of the ThreatQ Threat Intelligence Platform!

A new report by the Information Security Forum (ISF) entitled Threat Intelligence: React and Prepare is making headlines with its main finding that 25% of companies surveyed feel that threat intelligence is delivering on its promise.

There have been many published articles that have covered the values and outcomes of leveraging the ThreatQ Platform’s Adaptive Workbench.

As a security professional, I am always amused by the reaction to 0day announcements. On one hand, there is always a strong interest in technically understanding the vulnerability and how it is exploited.

One of the silver-lining effects of a global cyber scare such as WannaCry ransomware is the trigger to catch up with friends to discuss fact vs. fiction of the threat research and other ‘bigger picture’ observations.

In mid-2010 I was running a large Defense contractor SOC and was forced to build what’s currently known as a threat intelligence platform (TIP).

Can you really “manage” threats? Is that even a worthwhile goal? And how do you define a threat?

Have you ever wanted to be alerted about new information related to the TTP of an adversary? Well now that’s possible!

In this post, we will look at “AutoFocus,” which gives access to Palo Alto’s Wildfire data and, when used with ThreatQ, allows you to more effectively and efficiently combat ransomware.

We have made significant changes to ThreatQ’s Recorded Future Custom Connector to support Recorded Future’s new API changes and additional risk lists.

During the time when we were designing the initial phases of our threat intelligence platform (TIP), we determined that there were some important core principles that should drive how we built the product.

The ThreatQ platform offers a two-step resolution through our new scoring feature. It starts by properly scoring intelligence for your environment, which I’ve discussed in detail in multiple blogs and in a new whitepaper.