본문으로 건너뛰기
cccskills
무료GitHub에 공개

evaluating-threat-intelligence-platforms

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.

설치 방법 보기

이럴 때 유용합니다

  • Preparing requirements for TIP procurement
  • Comparing platforms before a TIP migration
  • Checking whether an existing TIP meets team needs
  • Designing trials, scoring criteria, and rollout plans

포함된 파일(4)

  • SKILL.md7.3 KB
  • LICENSE11.0 KB
  • references/api-reference.md2.7 KB
  • scripts/agent.py9.3 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Evaluating Threat Intelligence Platforms

When to Use

Use this skill when:

  • Conducting a formal RFP or vendor evaluation for a TIP solution
  • Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales
  • Establishing evaluation criteria aligned to organizational maturity and budget

Do not use this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities.

Prerequisites

  • Documented CTI program requirements: team size, feed sources, integration targets, use cases
  • Budget range and procurement timeline
  • Technical staff who will administer the platform (Python/API experience for open-source TIPs)
  • List of current and planned integrations (SIEM, SOAR, EDR, firewalls)

Workflow

Step 1: Define Evaluation Criteria

Structure requirements into mandatory (M) and desired (D) categories:

Core TIP Functions:

  • M: STIX 2.1 import/export with TAXII 2.1 server
  • M: REST API for automated IOC ingestion and export
  • M: Indicator deduplication and TTL management
  • M: TLP classification enforcement
  • D: Built-in MITRE ATT&CK integration and technique tagging
  • D: Graph visualization of indicator relationships
  • D: Workflow automation for analyst triage

Integrations:

  • M: SIEM integration (Splunk, Sentinel, QRadar) via syslog, API, or native connector
  • M: EDR integration for IOC push (CrowdStrike, Defender, SentinelOne)
  • D: SOAR integration (XSOAR, Splunk SOAR) for playbook triggers
  • D: Ticketing system (ServiceNow, Jira) for intelligence task tracking

Operational:

  • M: Role-based access control with TLP-aware data segregation
  • M: Audit logging for all analyst actions
  • D: Multi-tenancy for MSSP use cases

Step 2: Evaluate Major TIP Options

MISP (Open Source):

  • Cost: Free (self-hosted infrastructure cost only)
  • Strengths: Largest community, 250+ modules, extensive ISAC usage, STIX 2.0 native
  • Weaknesses: Requires dedicated admin, limited visualization, UI dated
  • Best for: Budget-constrained teams with technical staff; government/ISAC sharing programs

OpenCTI (Open Source):

  • Cost: Free (self-hosted); paid SaaS at ~$3,000–$15,000/year
  • Strengths: Native STIX 2.1, graph visualization, ATT&CK integration, modern API
  • Weaknesses: Resource-intensive deployment (Elasticsearch, MinIO required)
  • Best for: Teams wanting open source with modern UX; SOC/CTI integration focus

ThreatConnect (Commercial):

  • Cost: $50,000–$500,000/year depending on scale
  • Strengths: End-to-end CTI lifecycle, playbook automation, TC Exchange marketplace, analyst workflow
  • Weaknesses: High cost; complex implementation; best value at larger scale
  • Best for: Mature enterprise CTI programs; MSSPs; red team/blue team integration

Anomali ThreatStream (Commercial):

  • Cost: $30,000–$200,000/year
  • Strengths: Strong feed aggregation, Splunk-native integration, extensive pre-built connectors
  • Weaknesses: Graph visualization weaker than OpenCTI; UI refresh lagging
  • Best for: Splunk-heavy environments; teams prioritizing feed volume over analysis workflows

EclecticIQ Platform (Commercial):

  • Cost: $40,000–$300,000/year
  • Strengths: STIX 2.1 native, collaborative intelligence workbench, strong European customer base
  • Weaknesses: Smaller partner ecosystem than ThreatConnect
  • Best for: Teams with MITRE ATT&CK-centric workflows; EMEA-focused organizations

Step 3: Conduct Proof of Concept

Request 30-day PoC from finalists. Test:

  1. Feed onboarding: Can your top 5 feeds be ingested within 4 hours?
  2. SIEM integration: Can enriched IOCs push to your SIEM in <5 minutes?
  3. ATT&CK mapping: Can analysts tag indicators with ATT&CK techniques efficiently?
  4. Report generation: Can the platform produce a tactical IOC bulletin with one click?
  5. API performance: Can the REST API handle 10,000 indicator queries per day?

Step 4: Score and Select

Use weighted scoring matrix (weight each criterion by organizational priority):

Criterion                 Weight   Vendor A   Vendor B
STIX 2.1 compliance       20%      95         85
SIEM integration          25%      90         70
ATT&CK mapping            15%      85         95
Cost (inverse)            20%      60         90
UI/analyst experience     10%      80         75
Vendor support quality    10%      85         80
TOTAL                     100%     82.0       81.5

Step 5: Implementation and Onboarding Planning

Plan 90-day implementation:

  • Week 1–2: Infrastructure deployment (cloud or on-prem)
  • Week 3–4: Feed onboarding and deduplication tuning
  • Week 5–6: SIEM/SOAR integration and testing
  • Week 7–8: Analyst workflow configuration and training
  • Week 9–12: Operational validation and go-live

Key Concepts

TermDefinition
TIPThreat Intelligence Platform — software for collecting, processing, analyzing, and disseminating cyber threat intelligence
TAXII ServerComponent of a TIP that serves STIX bundles to consuming systems on request
TC ExchangeThreatConnect's commercial marketplace for pre-built feed integrations and app connectors
Multi-tenancyTIP capability to serve multiple organizational units or customers with isolated data environments
DeduplicationProcess of identifying and merging duplicate indicators within a TIP to reduce analyst noise

Tools & Systems

  • MISP: Open-source TIP used by 6,000+ organizations; strongest ISAC/government community integration
  • OpenCTI: Modern open-source TIP with native STIX 2.1 and graph-based analysis
  • ThreatConnect: Enterprise commercial TIP with lifecycle management and SOAR playbook integration
  • Anomali ThreatStream: Commercial TIP with strong Splunk ecosystem integration
  • EclecticIQ: Commercial TIP with ATT&CK-centric workflow design

Common Pitfalls

  • Selecting TIP before defining requirements: Technology selection before use case definition leads to expensive mismatches.
  • Underestimating administration burden: MISP and OpenCTI require dedicated admin time (minimum 0.25 FTE); budget accordingly.
  • Ignoring data migration costs: Moving historical intelligence from one TIP to another is costly and often impractical for legacy systems.
  • Not testing SIEM integration in PoC: TIP value depends heavily on downstream integration quality; always test SIEM/SOAR connectivity during evaluation.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing saved credential exposure in authorized tests
  • Examining collected DPAPI files offline
  • Reviewing protected browser and RDP credentials
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing risky permissions identified in BloodHound
  • Validating account takeover without resetting a password
  • Generating directory change records during security exercises
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Define the assessment scope for systems handling controlled information
  • Calculate an SPRS score and prioritize unmet security requirements
  • Prepare security plans, remediation milestones, and assessment evidence
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Preserving a suspect drive before investigation
  • Creating evidence copies of USB devices or memory cards
  • Verifying that a disk image matches its source
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Auditing excessive Active Directory permissions
  • Investigating privilege escalation paths from ordinary accounts
  • Reporting affected objects and permission remediation recommendations
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Triage suspicious APK files without running them
  • Inspect dangerous permission combinations and suspicious API calls
  • Extract network indicators for malware detection rules
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

mukul975의 스킬 모두 보기

이 스킬의 문제 신고