Threat Intel Library

A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.

The threat information is available in the form of feeds. The feeds provides you with valuable threat data from sources such as STIX, MISP, and so on, which lists threat intelligence entities.

Threat Intelligence Security Center library explains how to browse through the data, by performing basic and advanced searches, and filtering rules, invoke import assistant, manually add threat intelligence records, take necessary actions such as adding to allow list, deny list, and watch list.

The detailed view provides the insights to the intelligence records and from list views you can perform quick actions on one or more records.

• TISC Data Model
  The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.
• TISC Library Objects form view
  The Threat Intelligence Security Center objects home page consists of the following features.
• TISC Library Repository
  IoC repository contains STIX objects, each of these objects contain a specific piece of information.
• Access Vulnerability Downstream actions
  Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.
• Deleting threat intelligence library records
  Delete threat intelligence library records such as observables, indicators, and objects.
• Export intelligence data
  Use the export feature to manually export the intelligence data in various formats.
• Confirm Potential Relationships from Related Records
  Confirm the relationships between the two SDOs.
• Automated Correlation
  Automated correlation helps you identify the relationships between observables, indicators, and objects.