31 Mar 2021

Top 13 Threat Intelligence for SOC Teams

Maltego Team

A Security Operations Center (SOC) team is tasked with continuously monitoring its environment in order to detect, analyze, and respond to cybersecurity incidents, and ultimately improve the security posture of the organization.

However, to effectively monitor their environment, it isn’t enough for SOC teams to deploy security systems and tools that will alert them to an indiscriminate number of events. They need to know what threat actors are doing, what their activity may look like, and how to find traces of said activity across their infrastructure.

Usually, the sort of traces that are left behind by threat actors and picked up by the monitoring systems will be either observables or even indicators of compromise (IOCs)—IP addresses, host and domain names, email address, filename and file hashes—which on their own and out of context won’t be enough to conduct an in-depth investigation.

For a proper analysis that can lead to attribution as well as to effective countermeasures against similar attacks being built, SOC analysts need to enrich and contextualize the traces found in their internal systems.

This is where an often-confusing concept comes in: Threat intelligence. To better understand it, we will walk through the most popular elements related to the subject matter.

Threat Intelligence: Sources, Feeds, Platforms, and Providers 🔗︎

Threat intelligence is actionable and timely knowledge that is rooted in data. It provides analysts with the necessary context to understand threat actor’s motivations, methods, tools, and infrastructure, thus helping them prevent or mitigate attacks.

Practically speaking, threat intelligence relevant to an organization is generated when combining the traces found in the organization’s internal telemetry—such as firewall and DNS logs—with threat data and information, be it via sources, feeds, platforms or providers.

Sources and Feeds 🔗︎

Open source intelligence (OSINT) and network telemetry constitute examples of threat intelligence sources. Threat intelligence feeds are non-prioritized streams of data that usually consist of non-contextualized IoCs or digital artifacts and focus on specific areas or data types such as suspicious domains, known malware hashes, and IP addresses associated with malicious activity, amongst others.

While free feeds are usually gathered from open sources, paid threat feeds may provide curated data from closed sources such as forums or constitute an aggregation of open-source feeds.

Platforms and Providers 🔗︎

A threat intelligence platform (TIP) is a software used to organize several feeds—free and paid—into a single stream. Lastly, a threat intelligence provider is a vendor that produces threat intelligence reports, for which they sometimes use a mix of human and automated analysis. The provider then offers the intelligence via premium data feeds, as a report, or as part of a software product. The human generated part may include TTP’s and attribution to a known Actor. The automated part is providing lists of observables in machine readable format.

A Dilemma: Incorporating Threat Intel into the SOC Team 🔗︎

It’s easy to see how one may stumble around in search for the right product to incorporate into their SOC team just by looking at the variety of options out there. With that in mind, SOC teams should first gain a comprehensive understanding of the following:

  1. Their network infrastructure
  2. The type of risks unique to their industry
  3. Where their security posture stands based on their current resources and capabilities to manage defensive and reactive activities
  4. Their available budget
  5. Resources they can dedicate to the project

However, even with the previous elements established, it is often difficult for SOC teams to choose the threat intelligence solution best suited to them, and to determine how to properly take advantage of the data it provides without further burdening the analysts. This is especially true for smaller, less mature teams that may not have the necessary tools, processes, or resources to help them prioritize data.

Maltego’s Top 13 Recommendations on Threat Intel for SOC Teams 🔗︎

According to the 2021 SANS Cyber Threat Intelligence CTI survey published in January 2021, the types of threat intelligence that are most helpful to SOC team operations are:

  • Information about vulnerabilities being targeted by attackers
  • Detailed information about malware being used in attacks
  • Specific IOCs to plug into IT and security infrastructure to block or find attacks
  • Broad information about attacker trends
  • Threat behaviors and tactics, techniques, and procedures (TTPs) of the adversary (how they work)

Based on these criteria, in this whitepaper, we provide a list of high-quality threat intel options for small SOC teams that have proven to be amongst our end-users’ favorites and are suitable for all budget sizes. The list is sorted in alphabetical order and doesn’t indicate any ranking or preference.

Top 13 Threat intel providers for small SOC teams

Download this whitepaper for detailed descriptions and evaluations of the threat intelligence feed provided by each provider listed above. This will help you make accurate and suitable purchasing decisions for the needs and responsibilities of your SOC teams.

Don’t forget to follow us on Twitter and LinkedIn or subscribe to our email newsletter for more whitepapers, case studies, and SOC tips like this!

Download the resource

DE +49
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua & Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia Herzegovina +387
Botswana +267
Brazil +55
Brunei +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde Islands +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus North +90392
Cyprus South +357
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea - Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea North +850
Korea South +82
Kuwait +965
Kyrgyzstan +996
Laos +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mayotte +269
Mexico +52
Micronesia +691
Moldova +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Islands +672
Northern Marianas +670
Norway +47
Oman +968
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russia +7
Rwanda +250
San Marino +378
Sao Tome & Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovak Republic +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
St. Helena +290
St. Kitts +1869
St. Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syria +963
Taiwan +886
Tajikstan +7
Thailand +66
Togo +228
Tonga +676
Trinidad & Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +7
Turkmenistan +993
Turks & Caicos Islands +1649
Tuvalu +688
Uganda +256
UK +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
USA +1
Uzbekistan +7
Vanuatu +678
Vatican City +379
Venezuela +58
Vietnam +84
Virgin Islands - British +84
Virgin Islands - US +84
Wallis & Futuna +681
Yemen +969
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.