Like a journalist, a security analyst must check multiple sources for additional information to verify or invalidate an assumption. Until recently, this was a rather tedious task. An analyst would have to reference various threat intelligence sites, enter the observable information in question and merge that data back into the main view.

According to our research, analysts often do this with scrap paper and text files. Now researchers can compile this data into a collection on IBM X-Force Exchange to share findings with colleagues and the security community at large.

Simplify Threat Intelligence in X-Force Exchange

The newly introduced Threat Feed Manager simplifies the task of getting data out of various sources and into one view. You can enable those threat intelligence sources directly on the X-Force Exchange by providing the credentials of those providers. The platform will then integrate the data into X-Force Exchange directly without the need to access additional sources one by one.

As of now, the following third-party threat intelligence feeds are available in the Threat Feed Manager:

  • VirusTotal;
  • CrowdStrike;
  • BotScout;
  • PhishTank;
  • RiskIQ;
  • ReversingLabs; and
  • RecordedFuture.

How the Threat Feed Manager Works

To take advantage of this capability, IT professionals should first open the Settings page by opening the user side panel on the top right and clicking the link at the bottom. From there, navigate to the Integrations section and input the credentials of the third-party sources you want to access. The authentication required can vary from a simple token to an application program interface (API) key and password. Next, switch the Enabled button on to enable the source and find the report page you want to research, such as an IP address or URL. The platform will present data from the applicable configured sources.

To see for yourself how easy it is to integrate threat intelligence data in X-Force Exchange, check out this 30-second video:

https://www.youtube.com/watch?v=mJ9EsqOq_zU

You can also register for a webinar titled “Transform Threat Intelligence Into Prevention in Minutes” to learn more about using threat intelligence in your security program.

Register for the webinar Now

More from Threat Intelligence

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

Strela Stealer: Today’s invoice is tomorrow’s phish

12 min read - As of November 2024, IBM X-Force has tracked ongoing Hive0145 campaigns delivering Strela Stealer malware to victims throughout Europe - primarily Spain, Germany and Ukraine. The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. During the past 18 months, the group tested various techniques to enhance its operation's effectiveness. Hive0145 is likely to be…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today