Threat Intelligence

### Overview This session focuses on threat intelligence as the third pillar of the organization's member services. The speaker outlines the various threat intelligence capabilities provided to members, explaining how threat data is gathered, delivered, and integrated to enhance organizational defenses.

### Key Topics - **Sensitive Information Alerts:** Monthly alerts generated based on member-nominated domains, dark web scanning, paid commercial feeds funded by membership fees, and intelligence shared by international CERTs. - **Malicious URL Feeds:** A high-confidence intelligence feed populated with phishing and malware links discovered by internal analysts, member submissions, and phishing takedowns. - **Open-Source Intelligence and Sharing Platforms:** Utilization of MISP (and Ahecs MISP for the higher education sector) to correlate indicators of compromise (IOCs) and enable cross-platform threat sharing.

### Technical Details - **Delivery and Integration:** Sensitive information alerts are notified via email directing users to a downloadable file in the member portal, with an API delivery service currently in testing. The malicious URL feed is accessible through the portal, via direct APIs, and through MISP feeds. - **Defensive Use Case:** The malicious URL feed is described as a high-confidence, "set and forget" service designed to be added directly to firewall blocklists as an additional protective layer. - **MISP Deployment:** The organization has utilized MISP for five to six years. The open-source platform, originally developed by the CERT team in Luxembourg, helps correlate technical IOCs across targeted environments. While predominantly utilized by more mature member organizations, it also offers entry points via automated feeds and APIs.

### Takeaways Members are encouraged to adopt these threat intelligence feeds upon joining, particularly the malicious URL feed for firewall blocking and MISP or API integrations for automated defense and indicator correlation. The transcript focuses strictly on service delivery mechanisms, and deeper technical threat indicators or specific CVE data are not discussed in this segment.