-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Operationalizing Threat Intelligence
By :

Analyzing, enriching, and understanding malicious infrastructure is valuable when you're creating actionable intelligence that is timely, actionable, and relevant. Malicious infrastructure can originate from virtually anywhere, including logs, OSINT feeds, and blocklists.
When you're analyzing malicious infrastructure, there are many ways to enrich and analyze infrastructure-based IOCs. In terms of the specifics, we'll focus on three primary datasets that we extract intelligence value from – DNS, WHOIS, and passive DNS. When analyzed individually, these three datasets and their data often do not indicate maliciousness directly. However, when analyzed together, intelligence and maliciousness are often more easily understood and determined.
Each dataset provides analytical value, as we'll see in the following subsections.
The Domain Name System (DNS) is a foundational concept in computer networking...
Change the font size
Change margin width
Change background colour