TIP of the Iceberg: Lessons Learned from Building a Threat Intelligence Platform

### Overview In this talk, Martin Eian, Head of Research at mnemonic, presents lessons learned from designing and building the ACT (Actionable Cyber Threat Intelligence) platform over a three-year period. Emphasizing threat intelligence as structured 'knowledge' (understanding causes and effects) rather than isolated data points, Eian explains why existing threat intelligence platforms failed to meet requirements around automation, knowledge representation, granular access control, and uncertainty quantification. The ACT platform was developed as an open-source graph database solution tailored to analysis and automated threat management.

### Key Topics - **Knowledge vs. Data**: Data points (like isolated IP addresses) have limited value on their own. Threat intelligence requires capturing meaningful relations, turning raw data into actionable information and knowledge. - **Graph Database Architecture**: Implementing ACT natively as a graph database rather than merely a graph visualization allows analysts and automated workers to traverse complex relationships and execute graph queries. - **Low-Level Data Model**: Defined using unique objects (e.g., IPv4 addresses, domains, tools) and immutable facts (edges or properties) that are timestamped, owned, backed by evidence, and subject to granular access controls. - **Pivoting and Graph Bridging**: Overcoming isolated information islands through enrichment (such as passive DNS) and unconventional pivot points (like splitting URLs into hosts, paths, and query parameters to track phishing kits). - **Classifiers and Ontologies**: Leveraging antivirus signatures on VirusTotal to bridge low-level technical observables directly to tactical frameworks like MITRE ATT&CK. - **Data Quality, Curated Sources, and Vocabularies**: Trade-offs between centralized, strictly curated repositories (MITRE ATT&CK) and community-driven platforms (MISP Galaxy), along with the importance of adhering to standardized vocabularies (e.g., STIX 2.0 industry sectors).

### Technical Details - **Object and Fact Semantics**: Objects are globally unique by type and value combination. Facts represent immutable properties or relations connecting objects. Erroneous data cannot be edited or deleted; instead, a new fact retracts the previous claim. Timestamps enable analysts to rewind historical states to evaluate what information was known at any given time. - **Uncertainty Quantification**: Certainty is calculated as the mathematical product of a user-assigned source trust score (0 to 1) and the source's confidence score (0 to 1). However, Eian noted a significant gap in real-world feeds: almost no threat sources or AV engines provide machine-readable confidence scores. - **Alias Handling**: A major initial mistake was linking threat data directly to an arbitrarily chosen canonical name (e.g., assigning all Sofacy or Fancy Bear data directly to APT28). If an alias association is later invalidated, uncoupling the data becomes messy. ACT instead attaches facts strictly to the specific identifier supplied by the source and models aliases as distinct relationships. During automated graph traversal, encountering an entity triggers an alias resolution step that expands the search across all associated alias objects. - **Access Control & Multi-Tenancy**: Built with both role-based and explicit access control down to the individual fact level, allowing multi-tenant sharing with strict restrictions.

### Takeaways - **Think in Relations**: Threat sharing should focus on source-relation-destination triplets rather than raw flat feeds. - **Consumption vs. Sharing Friction**: Prioritizing loose, highly flexible sharing formats makes automated consumption and correlation significantly harder. Reliable automation requires consistent data structures and strict vocabularies. - **Open Source and Future Work**: The ACT platform is open source under an ISC license on GitHub, accompanied by a public read-only demonstration instance on AWS. Ongoing work under the SOCCRATES project explores automated adversary emulation plan generation and technique sequencing using precondition/postcondition definitions.