Cyber Threat Intelligence

  1. Data Sources for Threat Intelligence
    1. Internal Sources
      1. SIEM Logs
        1. Event Correlation
          1. Alert Generation
          2. Network Security Systems
            1. IDS/IPS Data
              1. Network Traffic Analysis
              2. Endpoint Security Data
                1. EDR Information
                  1. Host-Based Monitoring
                  2. Incident Response Reports
                    1. Post-Incident Analysis
                      1. Lessons Learned
                      2. Vulnerability Management Data
                        1. Scan Results
                          1. Patch Management Information
                          2. Ticketing and Case Management Systems
                            1. Email Security Gateway Data
                            2. External Sources
                              1. Open-Source Intelligence
                                1. Security Blogs and News
                                  1. Social Media Intelligence
                                    1. Government Reports
                                      1. Academic Research
                                        1. Public Code Repositories
                                          1. Paste Sites and Forums
                                          2. Commercial Sources
                                            1. Threat Intelligence Feeds
                                              1. Vendor Reports
                                                1. Private Security Forums
                                                2. Information Sharing Communities
                                                  1. ISACs
                                                    1. Trust Groups
                                                    2. Human Intelligence
                                                      1. Insider Information
                                                        1. Industry Contacts
                                                        2. Signals Intelligence
                                                          1. Network Traffic Interception
                                                            1. Communication Monitoring
                                                            2. Dark Web and Deep Web Sources
                                                            3. Source Reliability Evaluation
                                                              1. Credibility Assessment
                                                                1. Timeliness and Accuracy Validation

                                                              Previous

                                                              3. Types of Threat Intelligence

                                                              Go to top

                                                              Next

                                                              5. Analysis Techniques and Frameworks