Threat Intelligence

The operator’s pointer list when they need IOC feeds, sandboxes, TTP libraries, or vendor reporting for collection, triage, or attribution. Most working analysts orbit two or three of these plus MITRE ATT&CK; the community-curated link sets cover the long tail.

References

• MITRE ATT&CK

• Mandiant Advantage threat intelligence

• Microsoft Threat Intelligence

• awesome-threat-intelligence

• awesome-threat-detection

• YARA for rule-based classification.

• tcpdump for the capture side.