Not all TIP technology solutions are created equal
The Benefits of a TIP
If the business questions why the SOC team needs a TIP, it delivers plenty of benefits: It can reduce risk, improve defenses, and enable the organization to execute strategic and tactical enterprise goals while staying on budget.
The organization can arm its SOCs, incident response teams, and threat intelligence analysts with a platform to efficiently structure, organize, and utilize threat intelligence across the enterprise. This platform also helps security analysts improve situational understanding, accelerate detection and response, maximize existing security investments, and collaborate more effectively as a team.
Incident response teams can automate the prioritization of threats and security incidents, accelerate investigations, and automatically push intelligence to detection and response tools. Threat intelligence analysts can efficiently structure and organize threat intelligence with context and prioritization to build adversary dossiers, make better decisions, and take action.
Asking the Right Questions
With stakeholders now convinced, other business questions will be considered alongside technical questions. Some key questions SOC teams should be thinking about asking the vendor are outlined here:
- How does the platform consume structured and unstructured data and how many “out-of-the-box” commercial feeds and/or open-source feeds do you have?
- What about context and transparency? For example, are customer-defined IOC tags/context/attributes shared across the vendors’ other customers?
- What about scoring and prioritization? Can customers customize scoring based on their own organization, team, resources, and capability without broadcasting those customizations to other customers? Is the vendor scoring transparent?
- What is the vendor’s approach to the expiration of intelligence?
- What about correlating internal and external data? If bi-directional data is enabled, does your company have sole ownership rights to my company’s data within the system?
- Do you have bidirectional integration with all SIEMs, ticketing systems, vulnerability management solutions, and SOAR solutions?
- With notifications and alerts, can an analyst create an alert list within your dashboard for any object/node in the system?
- Can we opt in and opt out of sharing data with a vendor or community when it comes to sharing and collaboration?
- Does the TIP support data-driven automation natively and through API integration with SOAR platforms?
This is not an exhaustive list. Questions about pricing models, service and support, different use cases, and questions specific to each SOC team’s environment will also be asked. Hopefully, this will help put the SOC team on the right path, armed with key questions to ask and potential hidden risks, to navigate the process successfully, and to find the right platform to meet their requirements.
link
