Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
Instrucciones de origen · Vista previa de solo lectura
name
building-threat-intelligence-platform
description
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX/TAXII interoperability, and building analyst dashboards for CTI operations.
When to Use
When deploying or configuring building threat intelligence platform capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
MISP↔OpenCTI connector duplication: running both a push sync and the OpenCTI MISP connector without a stable STIX id/UUID mapping re-imports the same events as new indicators on every poll. Pin one direction of authority and let the connector dedup on STIX id.
STIX version drift: MISP exports STIX 2.0 or 2.1 depending on version; OpenCTI 6.x expects 2.1. A 2.0 bundle using labels instead of indicator_types imports with empty typing. Confirm both ends negotiate application/stix+json;version=2.1.
Cortex TLP gating: analyzers silently skip observables whose TLP exceeds the analyzer's max_tlp (e.g., submitting tlp:amber to a max_tlp:green analyzer), so enrichment looks "done" but ran nothing.
Elasticsearch single-node in prod: the sample compose ships discovery.type=single-node with xpack.security.enabled=false — fine for a lab, but unauthenticated and unsharded for real CTI data.
Verify: create one indicator in MISP, confirm it appears once (not duplicated) in OpenCTI, confirm a Cortex analyzer returns a report, and round-trip the TAXII export through stix2.parse to confirm SDOs/SROs survive.
Prerequisites
Docker and Docker Compose for deploying platform components
Python 3.9+ with pymisp, pycti, thehive4py libraries
Elasticsearch/OpenSearch cluster for data storage
Redis and RabbitMQ for message queuing
Understanding of STIX 2.1 data model and TAXII 2.1 transport
API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)
Key Concepts
TIP Architecture Components
Collection Layer: Feed ingestion from OSINT, commercial, and internal sources
Storage Layer: Elasticsearch/OpenSearch for indexed CTI data with STIX 2.1 schema
Analysis Layer: OpenCTI for knowledge graph analysis and MISP for IOC correlation
Enrichment Layer: Cortex analyzers for automated IOC enrichment
Response Layer: TheHive for case management and incident response integration
Sharing Layer: TAXII server for outbound intelligence sharing
Platform Integration Points
MISP <-> OpenCTI: Bidirectional sync via OpenCTI MISP connector
OpenCTI <-> TheHive: Alert/case creation from high-confidence indicators
TheHive <-> Cortex: Automated analysis and enrichment of case observables
All <-> SIEM: Real-time IOC push to Splunk/Elastic via API or Kafka
