Threat Intelligence Platforms and Tools
The Platforms and Tools domain tests whether you know what a TIP does, which standards move intelligence between systems, and which tool answers which analytic question.
What a TIP actually does
Collect, normalise, deduplicate, correlate, score, store and disseminate. It is not a SIEM: the SIEM detects on logs, while the TIP manages intelligence about adversaries and indicators. Common platforms include MISP (open source, taxonomies, galaxies, sharing communities), OpenCTI, ThreatConnect, Anomali, EclecticIQ and Recorded Future.
Standards and formats
STIX 2.1 defines the objects - indicator, malware, threat actor, campaign, relationship - and is transported by TAXII 2.1. TAXII is the pipe, STIX is the payload. YARA matches files, Sigma matches logs, OpenIOC is legacy. MISP feeds export to IDS rules and SIEM watchlists.
Pivoting tools
Maltego entity graphs and transforms, i2 Analyst's Notebook link analysis, Shodan and Censys for exposure, VirusTotal and sandboxes for reputation and behaviour, Passive DNS and RiskIQ for historical resolution, GreyNoise to filter internet background noise, urlscan.io for page capture.
Worked example
An email delivers a link to a login page on 185.x.x.x. VirusTotal shows 4/90 detections. Shodan reveals nginx with a self-signed certificate and 200 other vhosts - likely shared infrastructure. Passive DNS shows three other phishing domains on the IP in 60 days. GreyNoise classifies the host as malicious rather than benign scanner noise. Output: a STIX indicator with a 30-day TTL, pushed to the SIEM and proxy blocklist, with the shared-hosting caveat recorded.
Traps that cost marks
Confusing a TIP with a SIEM or SOAR, describing TAXII as a data format, blocking atomic indicators permanently despite IP reassignment, and treating a Maltego graph as an assessment rather than a collection aid.