2. USMC Veteran – 2651 Secure Comms/Intel SysAdmin +14 Years in Information Technology/Security Specialties: Incident Response/Forensics Threat Intelligence Offensive Security $dayjob = Senior Malware & Threat Intel Analyst $sidejob = AdroitSec LLC – Principal/Consultant

6. Or…

9. “Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes specifics on the tactics, techniques, and procedures of these adversaries. Threat intelligence's primary purpose is to inform business decisions regarding the risks and implications associated with threats.” - Forrester

15. . Etc.FeedsIOCs

17. Analysis Etc.FeedsIOCs

22. Prevention Detection

24. H/T: ThreatConnect

28. Threat Intel could be it’s own “Program”

29. Threat Intel Program OSINT Threat Research External Intelligence Services ISACs Firewall IPS/IDS Web Gateway Anti-Virus HIDs/HIPs DLP Network Endpoint SIEM Detection & Response Governance / Resistance

30. Realize that threat TI is 80% internal 20% external (relative to your business)

32. May not be a “technical” application

36. "A shiny threat intel capability without a mature IR capability is like putting a big ole fancy spoiler on a stock 4 cyl Dodge Neon.“ - @mattnels

39. Visibility SIEM/Logs Network Hosts Threat Intel Analysis Verification Containment Remediation CSIRT Security reviews Identity mgmt Security design/reqs Vuln Mgmt Security Operations Policy Risk Management Security program design Compliance Reporting Audit Resist DetectIR Plan Ops IR

40. Threat Intelligence Consumption Asset Classification and Security Monitoring Incident Response Threat & Environment Manipulation Source: RecordedFuture.com – Robert Lee

41. Logs Network Endpoint Threat Intel Focal points: Logs Network Threat Intel Endpoint

42. Logs Network Endpoint Threat Intel Recon Weaponization DeliveryExploitationC2Exfiltration

44. Scope, Relevancy, Context, Breadth, Capabilities