Threat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
summary
Argues that a threat library / threat intelligence management platform becomes the SOC cornerstone by automating ingestion, deduplication, enrichment and automated ingestion and push to SIEM/sensors so analysts stop copying indicators into spreadsheets; integrates with VirusTotal, passive DNS, YARA/Snort rules, malware emulation malware zoo and metrics for source value and supports dwell‑time and source‑quality metrics. Presents a surprising empirical result: commercial feeds show less than 1% overlap (three major feeds shared no IPs), so feeds are complementary not redundant.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:21Detection Evolution
- 2:40SOC Battle Rhythm
- 5:45Threat Intelligence Library
- 9:40Threat Intelligence Library Players
- 12:40Threat Intelligence Providers
- 17:46Overlap
- 20:46Whos Getting Me
- 21:20Timeline Analysis
- 24:24Open Source
- 26:39Conclusion
- 29:20Questions
related talks
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
41mBuilding a Valid Threat Library for Cloud Based Applications
25mORKL: Building an Archive for Threat Intelligence History
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
20mDynamic Defense: Crafting threat models with real-world Intelligence
20mMaximize the Value of Your Threat Intelligence