“threat-intelligence”的搜索结果

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

中文简介正在准备中。当前显示英语简介。

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

中文简介正在准备中。当前显示英语简介。

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting

中文简介正在准备中。当前显示原文说明。

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.

中文简介正在准备中。当前显示原文说明。

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat

中文简介正在准备中。当前显示原文说明。

Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T

中文简介正在准备中。当前显示原文说明。

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

中文简介正在准备中。当前显示原文说明。

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

中文简介正在准备中。当前显示原文说明。

Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T

中文简介正在准备中。当前显示原文说明。

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

中文简介正在准备中。当前显示原文说明。

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat

中文简介正在准备中。当前显示原文说明。

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

中文简介正在准备中。当前显示原文说明。

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat

中文简介正在准备中。当前显示原文说明。

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.

中文简介正在准备中。当前显示原文说明。

Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T

中文简介正在准备中。当前显示原文说明。

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

中文简介正在准备中。当前显示原文说明。

Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.

中文简介正在准备中。当前显示英语简介。

• Check public phishing reports for a suspicious domain
• Investigate scam or impersonation leads from public posts
• Prepare verified evidence for a security investigation

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

中文简介正在准备中。当前显示英语简介。

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

中文简介正在准备中。当前显示英语简介。

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

中文简介正在准备中。当前显示英语简介。

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.

中文简介正在准备中。当前显示英语简介。

• Investigating infrastructure linked to a phishing campaign
• Adding public evidence to threat actor profiles
• Reviewing an organization's external exposure

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

中文简介正在准备中。当前显示英语简介。

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization