Chapter 13: Developing the Core Threat Intelligence Team | 115

Additional sources
Proprietary sources that can strengthen your threat intel-
ligence resources include:

;; Vendor or ISAC feeds

;; Whitelists

;; Blacklists

;; Threat intelligence team research

Combining sources
An automated threat intelligence solution enables the threat
intelligence team to centralize, combine, and enrich data from
multiple sources before the data is ingested by other security
systems or viewed by human analysts on security operations
teams.
Figure 13-2 shows the elements of such an automated threat
solution. In this process, information from a threat intel-
ligence vendor is filtered to find data that is important to
the enterprise and specific cybersecurity teams. Then it is
enriched by data from internal threat intelligence sources and
output in formats appropriate for targets such as SIEMs and
incident response systems. This automated translation of data
into relevant insights is the very essence of threat intelligence.

  
    


 

  
 
 
 
 

  


Figure 13-2: A threat intelligence platform can centralize, combine, and enrich
data, then format it for multiple target systems. (Source: Recorded Future)