Solution
Threat intelligence
Threat intelligence tells security teams who is attacking, how, and with what. The most useful intelligence is early and specific: it flags attacker infrastructure before it is used, and it adds context to alerts so analysts can decide faster.
From reacting to getting ahead
Many feeds list indicators after an attack has already used them. By then the phishing email has been delivered and the malware has called home. Teams need intelligence that arrives earlier, connects related infrastructure, and plugs straight into the tools they run.
What good looks like
- Indicators that identify infrastructure before first use.
- Context on campaigns, tooling and related infrastructure for each alert.
- API and feed delivery into SIEM, SOAR and firewalls.
- Brand monitoring that finds impersonation domains early.
- Malware intelligence for file and network analysis.
Vendors that deliver this through Evanssion
| Vendor | Role in this solution |
|---|---|
| Silent Push | Indicators of Future Attack, threat hunting and brand protection built from DNS, web, certificate and WHOIS data |
| ReversingLabs | File and network threat intelligence from a very large malware and goodware corpus |
Questions to ask when choosing a solution
- How early does the intelligence arrive compared with common feeds?
- Can analysts pivot from one indicator to related infrastructure?
- How does it integrate with our SIEM and SOAR?
- What is the false-positive rate on blocking use?
Frequently asked questions
What is cyber threat intelligence?
It is information about attackers, their methods and their infrastructure, used to prevent, detect and respond to attacks.
What is the difference between an indicator of compromise and an indicator of future attack?
An indicator of compromise points to evidence of an attack that has happened. An indicator of future attack points to infrastructure that looks prepared for an attack that has not yet happened.
Who needs a threat intelligence platform?
Organisations with a security operations or incident response team, such as banks, telecoms and large enterprises, get the most value.