Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T. Use when working with building threat intelligence platform.
Instrucciones de origen · Vista previa de solo lectura
name
building-threat-intelligence-platform
description
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T. Use when working with building threat intelligence platform.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX/TAXII interoperability, and building analyst dashboards for CTI operations.
When to Use
Trigger phrases:
"building threat intelligence platform"
"Building a Threat Intelligence Platform (TIP) involves deploying and integrating"
When deploying or configuring building threat intelligence platform capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Docker and Docker Compose for deploying platform components
Python 3.9+ with pymisp, pycti, thehive4py libraries
Elasticsearch/OpenSearch cluster for data storage
Redis and RabbitMQ for message queuing
Understanding of STIX 2.1 data model and TAXII 2.1 transport
API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)
Key Concepts
This section covers key concepts for building threat intelligence platform.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
TIP Architecture Components
Collection Layer: Feed ingestion from OSINT, commercial, and internal sources
Storage Layer: Elasticsearch/OpenSearch for indexed CTI data with STIX 2.1 schema
Analysis Layer: OpenCTI for knowledge graph analysis and MISP for IOC correlation
Enrichment Layer: Cortex analyzers for automated IOC enrichment
Response Layer: TheHive for case management and incident response integration
Sharing Layer: TAXII server for outbound intelligence sharing
Platform Integration Points
MISP <-> OpenCTI: Bidirectional sync via OpenCTI MISP connector
OpenCTI <-> TheHive: Alert/case creation from high-confidence indicators
TheHive <-> Cortex: Automated analysis and enrichment of case observables
All <-> SIEM: Real-time IOC push to Splunk/Elastic via API or Kafka
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
