Threat Intelligence Tools and Platforms
This domain tests practical workflow: which platform owns which function, how to pivot from an atomic indicator to behaviour, and where automation quietly degrades quality.
The platform stack
- TIP (MISP, OpenCTI): store, normalise, correlate, and share intelligence; feeds in, products out.
- Case management (TheHive with Cortex analysers): investigation workflow plus automated enrichment.
- Sandboxes (CAPE and commercial equivalents): dynamic analysis producing behavioural and network artefacts.
- Internet-wide scanners (Shodan, Censys): exposure checks and infrastructure pivoting.
- Multi-scanner reputation (VirusTotal): file, URL, and domain context - a starting point, not a verdict.
- Passive DNS and certificate transparency: infrastructure history and clustering.
- Link analysis: visual pivoting across entities such as domains, certificates, and registrants.
- Detection formats: YARA for files and memory, Sigma for log-based detections, STIX/TAXII for exchange.
- SIEM and SOAR: operationalise detections and response actions; SOAR executes, it does not analyse.
Pivoting
The core skill is moving between entity types: hash → sandbox report → dropped domain → passive DNS → registrant email or TLS certificate → co-hosted infrastructure → additional samples. Record each hop so the chain can be reviewed and re-run.
Automation cautions
API keys in scripts leak; rate limits throttle pivots; enrichment is not correlation. Feed overlap inflates counts. A single low detection ratio is weak evidence either way - first-seen dates and signer information are stronger. Public sandboxes expose submitted samples to adversaries and other users, so never upload confidential material.
Worked example
A hash from an EDR alert goes to an internal sandbox. The report shows a beacon domain, scheduled-task persistence, and a mutex. Pivot one: passive DNS on the domain returns an IP and a registrant-linked certificate. Pivot two: the certificate's serial range returns six more domains, two already in a commercial feed. Pivot three: search those domains in the TIP; one has an older sample with a matching mutex, clustering both to the same loader family. Output: a YARA rule on the mutex and loader strings, a Sigma rule for the scheduled task, and a TIP event linking the infrastructure - each tagged with the pivot that produced it. Submitting the hash to a public multi-scanner first would have tipped off the operator.
Traps
Treating a scanner detection count as a confidence score. Uploading sensitive samples to public services. Confusing a TIP with a SIEM, or SOAR with analysis. Building pivot chains with no recorded provenance. Assuming Sigma rules run unmodified on every backend - they must be translated and tested.