Like a journalist, a security analyst must check multiple sources for additional information to verify or invalidate an assumption. Until recently, this was a rather tedious task. An analyst would have to reference various threat intelligence sites, enter the observable information in question and merge that data back into the main view.
According to our research, analysts often do this with scrap paper and text files. Now researchers can compile this data into a collection on IBM X-Force Exchange to share findings with colleagues and the security community at large.
Simplify Threat Intelligence in X-Force Exchange
The newly introduced Threat Feed Manager simplifies the task of getting data out of various sources and into one view. You can enable those threat intelligence sources directly on the X-Force Exchange by providing the credentials of those providers. The platform will then integrate the data into X-Force Exchange directly without the need to access additional sources one by one.
As of now, the following third-party threat intelligence feeds are available in the Threat Feed Manager:
- VirusTotal;
- CrowdStrike;
- BotScout;
- PhishTank;
- RiskIQ;
- ReversingLabs; and
- RecordedFuture.
How the Threat Feed Manager Works
To take advantage of this capability, IT professionals should first open the Settings page by opening the user side panel on the top right and clicking the link at the bottom. From there, navigate to the Integrations section and input the credentials of the third-party sources you want to access. The authentication required can vary from a simple token to an application program interface (API) key and password. Next, switch the Enabled button on to enable the source and find the report page you want to research, such as an IP address or URL. The platform will present data from the applicable configured sources.
To see for yourself how easy it is to integrate threat intelligence data in X-Force Exchange, check out this 30-second video:
https://www.youtube.com/watch?v=mJ9EsqOq_zU
You can also register for a webinar titled “Transform Threat Intelligence Into Prevention in Minutes” to learn more about using threat intelligence in your security program.
Register for the webinar Now
Security Intelligence Staff