Threat Intelligence Platform (TIP).

What is a threat intelligence platform?

A threat intelligence platform is a tool that collects threat information from many places, stores it in one place and helps security teams use it. It is often shortened to TIP. The idea is to keep threat information organized so people and other tools can act on it.

NIST SP 800-150 defines cyber threat information as any information that can help an organization identify, assess, monitor, and respond to cyber threats. NIST says it includes indicators of compromise, tactics, techniques, and procedures used by threat actors, suggested actions to detect, contain, or prevent attacks, and findings from incident analysis.

How does a threat intelligence platform work?

NIST says organizations may collect indicators from open source repositories, commercial threat feeds and external partners. A platform is a place where such inputs can be gathered. This is a plain description, not a NIST definition of the product type.

NIST describes indicators as technical artifacts or observables that suggest an attack is imminent or underway, or that a compromise may already have happened. Its examples include the IP address of a suspected command and control server, a suspicious domain name, a URL that points to malicious content, a file hash for a malicious executable, and the subject line of a malicious email.

NIST says automated techniques can make indicators available more quickly and reduce manual effort. It adds that manual handling of indicators can be time-consuming, tedious, error-prone, and slow. NIST says automation lets analysts focus on interpretation instead of routine data work.

What are STIX and TAXII?

NIST says common data formats and transport protocols enable automation and let organizations, repositories, and tools exchange threat information at machine speed. Two well-known standards from OASIS serve this purpose.

• STIX is, in the words of the OASIS specification, a language and serialization format used to exchange cyber threat intelligence in a consistent and machine-readable manner.
• TAXII is an application layer protocol for the communication of cyber threat information in a simple and scalable manner. It is designed to carry threat intelligence written in STIX.

A platform that supports these standards can often exchange information with other tools that support them. This is generic reasoning, not a claim about any one product.

Why do organizations share threat information?

NIST lists several benefits of sharing. Shared situational awareness lets partners use each other’s knowledge and analysis, and NIST says even a single new indicator can raise the awareness of a whole community. NIST says an improved security posture lets organizations identify affected systems, implement protective measures, enhance detection and respond to incidents.

How does it relate to nearby terms?

Threat intelligence is the information itself, and a platform is a tool for handling it. An indicator of compromise is one kind of item such a platform can hold. The related terms are listed on this page.

Is a threat intelligence platform the same as threat intelligence?

No. Threat intelligence is the knowledge about threats. A platform is software used to collect, organize and share that knowledge.

Do small teams need automation to share threat information?

NIST notes that most organizations can receive threat information through email lists, text alerts and web portals without special infrastructure, although the content may need manual processing. Organizations with tools that support standard formats can use standards-based feeds for semi-automated ingest and use.

Platforms can exchange intelligence using the open standards STIX and TAXII.