| name | evaluating-threat-intelligence-platforms |
| description | Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
|
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["TIP","ThreatConnect","MISP","OpenCTI","Anomali","EclecticIQ","STIX-TAXII","CTI-program","procurement"] |
| version | 1.0.0 |
| author | team-cybersecurity |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Evaluating Threat Intelligence Platforms
When to Use
Use this skill when:
- Conducting a formal RFP or vendor evaluation for a TIP solution
- Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales
- Establishing evaluation criteria aligned to organizational maturity and budget
Do not use this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities.
Detection Gaps & Validation
- PoC coverage gaps: vendor demos use curated feeds. Validate against YOUR top 5 feeds and YOUR SIEM, not the vendor's sample data - STIX 2.1 import that works on clean bundles often fails on real-world malformed objects.
- STIX/TAXII version mismatch: a TIP advertising "STIX support" may only do STIX 2.0 or partial 2.1 (missing
infrastructure/grouping SDOs or sighting SROs). Test round-trip export/import of every SDO/SRO type you actually use.
- Dedup over-merge: aggressive deduplication can collapse distinct indicators (same IP, different context/TLP) and hide detections. Verify TLP and source survive a merge before trusting indicator counts.
- Integration latency: "real-time" SIEM push can lag minutes to hours. Measure actual enriched-IOC-to-SIEM time during the PoC with a planted test indicator, not the datasheet number.
- How to validate: weight the scoring matrix by your real use cases, run the 30-day PoC at production-representative volume (10k+ queries/day), and confirm a known test IOC traverses ingest → dedup → ATT&CK tag → SIEM export intact.
Prerequisites
- Documented CTI program requirements: team size, feed sources, integration targets, use cases
- Budget range and procurement timeline
- Technical staff who will administer the platform (Python/API experience for open-source TIPs)
- List of current and planned integrations (SIEM, SOAR, EDR, firewalls)
Workflow
Step 1: Define Evaluation Criteria
Structure requirements into mandatory (M) and desired (D) categories:
Core TIP Functions:
- M: STIX 2.1 import/export with TAXII 2.1 server
- M: REST API for automated IOC ingestion and export
- M: Indicator deduplication and TTL management
- M: TLP classification enforcement
- D: Built-in MITRE ATT&CK integration and technique tagging
