“stix”的搜索结果

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

中文简介正在准备中。当前显示英语简介。

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

中文简介正在准备中。当前显示英语简介。

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

中文简介正在准备中。当前显示英语简介。

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

中文简介正在准备中。当前显示英语简介。

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

中文简介正在准备中。当前显示英语简介。

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

中文简介正在准备中。当前显示英语简介。

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

中文简介正在准备中。当前显示英语简介。

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

中文简介正在准备中。当前显示英语简介。

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

中文简介正在准备中。当前显示英语简介。

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

中文简介正在准备中。当前显示英语简介。

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

STIX 2.1 bundle creation reference. Object types, relationships, and JSON templates for structured threat intelligence sharing. Includes the per-claim mapping of evidence grades (access level and claim support) from /quality-of-information-check to STIX confidence, and the reverse mapping on import.

中文简介正在准备中。当前显示原文说明。

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

中文简介正在准备中。当前显示原文说明。

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

中文简介正在准备中。当前显示原文说明。

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.

中文简介正在准备中。当前显示原文说明。

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

中文简介正在准备中。当前显示英语简介。

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

中文简介正在准备中。当前显示英语简介。

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

中文简介正在准备中。当前显示英语简介。

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting

中文简介正在准备中。当前显示原文说明。

Use when you need to query an OpenCTI instance — is this IOC already known, what entities/reports/campaigns exist for an actor — or push new intel into it — creating indicators/observables, labelling, TLP markings, relationships, or importing a STIX 2.1 bundle. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already in your knowledge base, and by analytical skills that want to publish their findings back to OpenCTI. Reads $OPENCTI_URL and $OPENCTI_TOKEN.

中文简介正在准备中。当前显示原文说明。

IOC export formats and procedures. CSV, STIX 2.1, OpenIOC, MISP. Handles format conversion and packaging, and carries per-claim evidence grades (access level and claim support) from /quality-of-information-check into each format (STIX confidence, MISP attribute tags).

中文简介正在准备中。当前显示原文说明。

Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already known to your CTI sharing community, and by analytical skills that want to publish their findings back to MISP. Reads $MISP_URL and $MISP_API_KEY.

中文简介正在准备中。当前显示原文说明。