Put threat intelligence into action with security apps

It’s now easier than ever to make threat intelligence from IBM X-Force Exchange actionable. Since its inception in 2015, X-Force Exchange has provided both granular indicators of compromise and higher-order intelligence through public collections to help shorten security investigations.

A recent update to the X-Force Exchange collaborative platform now offers recommended apps from the companion IBM Security App Exchange, based on the content of public collections, to help users implement threat intelligence into their end-to-end security portfolio.

The Petya ransomware campaign in Europe earlier this year worked quickly. With the attack intending to destroy data rather than hold it hostage, every minute mattered. By using the recommendation engine on X-Force Exchange, users researching the “Petya Ransomware Campaign” public collection on IBM X-Force can now view related apps from App Exchange that can help put threat intelligence on Petya into action.

Users of the IBM X-Force Exchange will now see suggested apps from the App Exchange relevant to the content they are viewing.

In this case, the Threat Intelligence app for QRadar will add real-time threat intelligence from X-Force Exchange into the IBM QRadar SIEM — including any related reports on IP addresses and known malware hashes. In addition, the RFISI app provides additional rules in QRadar that implement the Threat Intelligence integration strategy and the NotPetya Content Pack adds additional detection based on Snort signatures and collaboratively developed threat intelligence to offer higher-fidelity detection of the NotPetya variant.