Skip to main content

Threat Intel and Clicks

· 3 min read

When a security analyst investigates an unknown IP address or domain, one of the first steps is often to check it against a threat intelligence provider.

You can automate that lookup with a button.

The analyst clicks it, the IOC is sent to the provider, and the result appears in the interface.

That's useful, but is this a good automation?

Not really.

You automated the action, but the analyst still has to make the same decision:

Is this IOC worth investigating?

That's where security automation can go further: instead of automating the action, automate the decision that follows it.

The lookup is the easy part​

Threat intelligence gives you evidence about an IOC, but someone still has to decide what that evidence means.

A provider might return signals such as confidence in the intelligence, when the activity was observed, and information about the IOC's context.

For example, a workflow could evaluate:

  • Whether useful context exists for the IOC
  • How much you trust the source (one of many!)
  • How recently and how often the IOC was observed
  • The relevance of the IOC in accordance to your environemnt
tip

This is heavily inspired by RST Cloud's TI Scoring

Now you have high-confidence, relevant IOCs that can be used as enrichments in your alerts and other risk signals.

The scoring formula replaces a decision the analyst used to make every time, now encoded once as policy.

Bad data makes bad decisions at scale​

Automated decisions depend on the data behind them.

Before a decision can be made, security data must be collected, normalized, enriched, and correlated so that the scoring policy has the context it needs.

The better this data pipeline becomes, the more repeatable decisions you can move from the analyst.

For more on the data layer behind security automation, see Building a custom ETL pipeline for security data by Alexander Bolshakov.

Also check out Why OCSF is awesome for some thoughts on why good data is important for security automation.

Automation should remove decisions​

A lookup button is still worth building. It saves time and reduces friction.

But if the analyst has to read the result and judge it every time, you've only automated the easy half.

The clicks disappear first.

The real gain comes when the routine decisions disappear with them.