Filtering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
summary
Community MISP pipeline uses PyOTI enrichment modules to run dozens of API lookups (Circle Hash Lookup, VirusTotal, Greynoise Riot, Cisco Umbrella), tags results with a machine-readable PA ODi taxonomy, and applies an RH-ISAC vetted tag when simple vetting logic passes. The feed ingests ~9,000 indicators per quarter, achieves ~45–48% automated vetted rates, serves ~350 members with 139 integrations and nine automated sharers, and caches lookup results for 72 hours to reduce API load and false positives.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:49ISAC model and MISP role
- 3:52Low-fidelity feeds and analyst fatigue
- 5:15Low-regret methodology
- 6:58Normalizing enrichment with Python OTI
- 9:05Enrichment services and false positives
- 10:53Enrichment taxonomy for tags
- 13:02RH-ISAC MISP workflow
- 15:14Handling false positives
- 16:38Hash enrichment examples
- 18:26Vetting methodology and MISP
- 19:29Tuning enrichment requirements
- 21:38Tagging over suppression
- 23:22Tuning as continuous process
- 24:46Key outcomes for RH-ISAC
- 26:10Quality lessons and recommendations
- 28:57Q&A: Vetting rates
- 29:17Q&A: Joining ISAC communities
related talks
43mOpen Source Intelligence Based Intrusion Detection System
55mCyber Security vs. Statistics
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
01h 27mOpen Data (OSINT) and Threat Intelligence Sharing Platforms and Tools
30mTrawling for IOCs: Catching C2 in a Sea of Data
37mThreat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities