Threat Intelligence¶

Threat Intelligence (TI) fetches information and insights about existing or potential cyber threats and risks from various sources. It then assembles, processes and analyzes the fetched information and uses it to predict data breaches, vulnerable attacks and any evidence of pre-planned attacks or threats and notifies about it in real-time. You can also link custom threat data sources and fetch and analyze their logs.

Supported Sources

• Emerging Threats

• Critical Stack

• CSIS

• Custom CSV

• MISP

• Blueliv

• Recorded Future

• StixTaxii

Threat Intelligence Components

1. Enrichment Source

   • ThreatIntelligence

2. Process Command

   • ti

3. Dashboard Package

   • LP_Threat Intelligence

4. Alert Packages

   • LP_Threat Intel Internal Machine Connecting to Multiple IOCs

   • LP_Threat Intel Excessive Denied Connections Attempt from IOC

   • LP_Threat Intel Connections with Suspicious Domains

   • LP_Threat Intel Allowed Connections from Suspicious Sources

   • LP_Threat Intel IOC Connecting to Multiple Internal Machines