I am coming up on my third year of planning a topic track for IBM Security at the IBM InterConnect conference, and each year brings even more exciting content. This year, the introduction of Watson for Cyber Security adds yet another dimension to the usefulness and applicability of external threat intelligence.

If you aren’t able to attend, fear not! The IBMGO app lets nonattendees live stream sessions and be part of the experience. If you are attending, check out some of the engaging content from IBM X-Force to help you apply external threat intelligence to your security operations to reduce your time to act on potential threats.

Get Ready for Collaborative Threat Intelligence

If you have implemented threat intelligence feeds in your operations but aren’t quite ready to dive into the sharing part of it, stop by the IBM Security booth Engagement Center to hear Paul Griswold talk about overcoming objections to threat intelligence collaboration and how to do it safely.

While you’re at the booth, stop by for a live demo of IBM X-Force Exchange. Our X-Force experts will be on hand to show you how to take advantage of new features and enhancements to help prevent attacks and speed security investigations.

If you want to ask experts about making the most of a threat intelligence application program interface (API), check out Session 7343 on executing X-Force Exchange API queries, what each returns and how the queries can be combined for different purposes, from vulnerabilities to malware to reputation scoring for IP addresses and URLs.

The hashes give local indicators to look for and information about malware. Family information gives more local indicators, or vulnerability IDs lead to product coverage, signatures and affected products. If you’re a seasoned X-Force Exchange user, please stop by one of our client feedback roundtables to give suggestions for improving the platform or the API and to dive deep on capabilities and future enhancements.

Applying Threat Intelligence for Operational Success

A number of IBM clients are scheduled to speak about how they have implemented threat intelligence solutions to streamline their operations. From the Royal Bank of Canada (Session 1408) to Schneider Electric (Session 3794), the combination of open standard threat intelligence implementation, security intelligence and incident response has raised the bar for these organizations.

In these sessions, clients will share their experience and process for setting up a security operations center (SOC) and incident triage and response plans while leveraging external threat intelligence. Combined with a robust security intelligence solution, one company found that first-level support security analysts were able to resolve 85 percent of incidents.

To take threat intelligence a step further, learn more about the repercussions next-generation attacks bring to SOCs. With more adversaries and attacks, along with the unforeseen consequences of political, technological and economic changes, SOC operators can be at a loss when it comes to taking in the right information to combat advanced attacks. Join Session 2011 with Etay Maor to learn more about using a cyber range and what IBM has learned from running the X-Force Command Center training facility.

Watson Can Help

Still at a loss on how to sort through the terabytes of threat intelligence that is available? Bring in IBM Watson. In Session 4657, “Applying Watson to Cyber Threat Intelligence,” experts from IBM X-Force Incident Response and Intelligence Services (X-Force IRIS) will discuss the benefits of applying cognitive security to cyberthreat intelligence to stay current with massive amounts of structured and unstructured data and how to assign context to known threats. You can also catch experts from X-Force IRIS at a Meet the Experts session on Wednesday morning for an open forum to ask anything you want about incident response and threat intelligence.

I’ve presented a lot of information about the variety of sessions available at InterConnect, so if you’re feeling overwhelmed trying to plan your agenda, fear not! IBM Watson can help you with that, too. To get help finding relevant sessions to take in, visit the InterConnect session planning site and ask Watson for help.

Learn more about the sessions at InterConnect 2017

More from Threat Intelligence

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today