Threat Intelligence Platforms (TIPs) are a great solution to centralize and manage multiple streams of threat intelligence. And despite the slowing adoption of TIPs in the past year, they’re still a big force in the market. If your organization is tentative about investing in a TIP, here’s everything you need to know.
How Threat Intelligence Platforms Work ?
TIPs combine multiple sources of TI in a unified environment to help SOCs, analysts and other security teams balance the intelligence they ingest.
Naturally, the primary function of TIPs is to aggregate data from multiple TI sources. They’ll usually demand that vendors to provide TI in a specific format or at least following a fixed vendor-specific schema. They’ll also perform normalization and deduplication on that raw data, but some also allow ingestion of free format data to adapt to the OSINT diversity.
Beyond this core function, TIPs might also provide tools to analyze threat intelligence, such as visualization, navigation, prioritization or alerting.
A lot of them also help partners integrate threat intelligence into existing tools like SIEM or SOAR through built in connectors
What do you need a TIP for ?
Before delving deeper into TIP features, it’s important to address the common use cases for it, and why you might (not?) want to invest in one.
Automation
Automation is one of the key functions of TIPs, as they can help security teams ingest large amounts of reputation/tactical TI from multiple vendors. This data can then instrument automated security tools, like NGFWs, IDPS, CASBs, and more.
Industry analysts agree that the TI market is dominated by “coopetition,” with customers working with multiple vendors at the same time, leveraging the pros of each to cover their bases.
This trend is ubiquitous across use cases, but it’s especially common among TI buyers looking for a TIP to enhance their automatic detection and protection systems. That’s because a TIPs normalization process helps security teams cut down on development costs.
SOC Analysts and Security Researchers
TIPs are equipped to help SOC analysts of all tiers in their day-to-day tasks. Threat intelligence is the lifeblood of security operations centers, so analysts can get a lot from a platform unifying their TI sources.
TIPs can be especially useful to SOCs when they offer data analysis capabilities, and the option to import other sources of TI, usually internal or reliable OSINT.
Lastly, TIPs that want to offer a seamless experience to SOCs and researchers also offer some form of dynamic malware analysis, to help with incident response, digital forensics, investigations, extracting TI, and more.
Management and Other Decision Makers
While a big focus of TIPs is on reputation and operational threat intelligence, some of them also feature feeds and services of strategic TI (aka topic-focused human-driven reports). These high-level reports outline industry trends, notable events, or other information that can inform decision making and resource allocation.
If strategic TI is a requirement for your intelligence needs, TIPs aren’t our first recommendation. Factual details supporting the reports will either be spare or insufficient. It’s better to work directly with TI vendors focused on the regions or types of threats relevant to you.
Crucial Features to Look for in a TIP
To understand the TIP requirements you have, it’s important to analyze a few details, such as data sources, your existing tool stack, and your operational needs.
Source of Data
No TI provider can give you full visibility into all kinds of threats. Even global vendors that have decent coverage will lack the needed depth of information, the actionable threshold confidence or speed of relaying the information. Some vendors can provide valuable vulnerability intelligence, others stand out with large amounts of raw data ready for MRTI (Machine-Readable Threat Intelligence) scenarios, and others are specialized in making the dark web easy to navigate.
The first step in deciding what TIP to invest in is to understand the various TI sources, and decide which vendors, or types of vendors, are important for your organization.
Type of Threat Intelligence
The TI medium doesn’t have a uniform nomenclature for different types of threat intelligence. We already wrote a thorough breakdown of the different types of threat intelligence, we recommend you read it too.
For a quick rundown, here’s how Bitdefender defines the different types of TI:
- Reputation TI: raw data from live sensors, usually indicators of compromise like file hashes, IPs, domains, etc.
- Operational TI: enriched and correlated IoCs, attributed to different threat actors, or types of threats like ransomware, phishing-and-fraud, etc.
- Strategic TI: recurrent and on-demand reports on customer interests, such as threat actors, malware types, geopolitical developments, and more.
Before investing in a TIP, it’s important to decide what type of threat intelligence your organization needs. If you need to improve automated detection, reputation TI is most valuable. If you operate a SOC, operational TI can be especially useful in investigations, threat hunting or incident response. If you need input in decision making, TIPs that feature strategic TI are ideal.
Integration and Standardization
TI providers use a variety of formats to deliver data, which can lead to incompatibilities between some vendors, and existing solutions in your organization. TIPs play a major role in standardizing the information coming from vendors, but they might also be incompatible with some solutions.
For example, if you already use Splunk or QRadar, look for a platform that makes integration with it seamless. If you already rely on the MISP format for some TI, but want to enhance it with commercial feeds, check if your preferred TIP supports MISP integration.
If you identify potential incompatibilities between your current solutions and a TIP, factor in the development resources required to parse data or build connectors.
Additional Features
Extra features can make or break threat intelligence platforms in some use cases. For example, analytics and data visualization tools around the relevant threat landscape are crucial for SOC analysts and security researchers. Other features to consider include alert management, MITRE TTP exploration tools, pricing, sandbox integration, threat and confidence scoring or dark web coverage.
Platform, Portal, or Direct Licensing?
Threat Intelligence Platforms have a lot of benefits, such as unifying multiple TI sources, normalizing data for partners, and offering additional analysis tools. However, there are also drawbacks.
Licensing TI through a TIP can be more expensive than going directly to the source. Plus, large quantities of data can be a drawback if you don’t have the resources to turn them into actionable information. They can create alert fatigue and generate a lot of noise in your systems.
An alternative is working with TI delivered directly from global vendors. It’s usually provided via simple APIs, and in various formats. This is the recommended option if you want full control over what kind of TI you buy, in what quantities, the level of detail and how you integrate it into an existing infrastructure.
More mature providers might also offer access to a dedicated Threat Intelligence Portal, where they centralize all their TI and make it accessible via an optimized, simple UI. This is the recommended option for SOC analysts and security researchers that use TI during investigations.