'taxii' 검색 결과

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Threat intelligence fusion skill for collecting, normalizing, deduplicating, enriching, and operationalizing IOCs and TTPs from OTX, MISP, abuse.ch, VirusTotal, Shodan, GreyNoise, Censys, CISA KEV, NVD, vendor blogs, and internal telemetry. Use to build STIX/TAXII feeds, ATT&CK-mapped actor profiles, prioritized blocklists, and detection-ready intel packages.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user asks about ISAC participation, TAXII feeds, MISP communities, FIRST, STIX-based sharing, or how to publish intelligence externally. Covers sharing models, standards, communities, and TLP-governed dissemination.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.