A threat intelligence team produces a report on a new APT group known for targeting specific industry sectors using novel obfuscation techniques. This report includes IOCs (Indicators of Compromise) a

Question

Options

• AThe IOCs should be immediately blocked at the firewall, and the TTPs added to a static incident
• BThe IOCs should be used to create new detection rules with a 'Critical' severity, and the TTPs
• CThe report should be circulated to all IT staff for awareness, and any alerts matching the IOCs
• DOnly the IOCs should be ingested into the SIEM as watchlists, and TTPs should be ignored as
• EThe intelligence should primarily be used for retrospective hunting exercises and not directly

• A
  4% (2)
• B
  73% (35)
• C
  15% (7)
• D
  6% (3)
• E
  2% (1)

Explanation

Integrating threat intelligence effectively means leveraging both IOCs and TTPs. IOCs (like hashes, IPs, domains) are excellent for creating specific, high-fidelity detection rules (Option B), which can be automatically assigned a high severity due to the known threat actor. TTPs, being behavioral patterns, are crucial for informing and refining incident categorization and prioritization beyond just IOC matches. By understanding the APT group's TTPs, security teams can: 1) Create more sophisticated detection logic in the SIEM/EDR, 2) Develop or modify XSOAR playbooks to look for combinations of events that align with these TTPs, and 3) Train analysts to recognize these behaviors, allowing them to dynamically assign higher priority to incidents exhibiting these characteristics, even if no explicit IOCs are present. This holistic approach significantly improves detection and response capabilities.

No community discussion yet for this question.