Doing Threat Intel the Hard Way - Part 6: Threat Intelligence Maintenance

<p>This is the sixth and final post in a series on manual IOC management for threat intelligence. See the previous posts:</p><p>Part 1: <a href="https://www.anomali.com/blog/introduction-to-manual-ioc-management-for-threat-intelligence">Manual IOC Management</a><br/> Part 2: <a href="https://www.anomali.com/blog/doing-threat-intel-the-hard-way-capturing-threat-intelligence">Capturing Threat Intelligence</a><br/> Part 3: <a href="https://www.anomali.com/blog/doing-threat-intel-the-hard-way-processing-threat-intelligence">Processing Threat Intelligence</a><br/> Part 4: <a href="https://www.anomali.com/blog/doing-threat-intel-the-hard-way-operationalizing-threat-intelligence">Operationalizing Threat Intelligence</a><br/> Part 5: <a href="https://www.anomali.com/blog/doing-threat-intel-the-hard-way-part-5-analyze-threat-intelligence">Analyze Threat Intelligence</a></p><h2>Threat intelligence Maintenance</h2><p>Once an analyst has decided on the validity of the threat, the output of that decision must be captured and stored, preferably within the system. If it was determined that an indicator was not a threat, that should be documented accordingly. If instead it was determined to be a threat, additional output could include notes, reports, recommendations or other documentation. It could also include additional information gathered about the indicators themselves. All this information should be easily accessible for future reference.</p><p>Indicators must also be maintained over time, meaning that some method of incorporating new information about existing indicators while retaining the previous information is required. Although today an IP may be actively engaged in brute force attacks, next week it might be cleaned up and reimaged. That same IP might be clean for two years before getting compromised again and put into service as a botnet C&C IP. Analysts need to be able to see these changes over time in order to avoid confusion in analysis. Additionally, if integration content, such as SIEM alert rules, is based on categories or other elements that change over time, automated monitoring may fail to detect new threats and may identify threats incorrectly.</p><h2>Conclusion</h2><p>Threat intelligence can offer concrete benefits to organizations, making security analysts more efficient and effective, but only if that intelligence has been managed correctly. Poorly managed threat intelligence can lead to incorrect decisions that may have lasting consequences for the business or organization.</p><p>I have attempted to lay out the steps necessary to create a manual threat intelligence management process. As you can see, it is a complex undertaking, that may require a significant investment of resources. Some organizations have the necessary resources and skill in-house to develop such a program. Many do not.</p><p>Given the level of ongoing effort required, even those capable of building their own may opt for a commercial threat intelligence management platform. It is important that you do an honest assessment of your own organization before starting this kind of project.</p>