The Role of ThreatExchange
summary
Facebook builds ThreatExchange, an API-based platform that shares indicators (IPs, domains, URLs), malware samples and Yara Suricata Bro Snort signatures with per-item visibility and confidence scores. It stems from a 2013 Reger botnet that used one‑time Tumblr URLs and fake emails. Data lives in a graph database, supports REST/JSON queries and client libs (PHP/Python/Ruby/JS), ingests ~20 OSINT feeds, and mostly publishes publicly. Adoption across sectors reduces blind spots and makes some attacks harder to reuse via the Traffic Light Protocol.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:40What is ThreatExchange
- 14:09ThreatExchange community
- 15:04ThreatExchange example
- 16:07How can you help
- 17:34Sign up portal
- 17:56Data ownership
- 19:30Data sharing
- 20:42ThreatExchange vs VirusTotal
- 21:33Visibility
- 24:25Speeding up response time
- 25:55Questions
related talks
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
01h 27mOpen Data (OSINT) and Threat Intelligence Sharing Platforms and Tools
25mORKL: Building an Archive for Threat Intelligence History
37mThreat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
55mCyber Security vs. Statistics
41mThe Art of Threat-Informed Sharing: Real-life Use Cases from NSA