0
4.2.0
Australia, Zurich, Yokohama, Xanadu
Standalone Application
Threat Intelligence Security Center (TISC) is a comprehensive platform designed to bolster organization's cybersecurity posture by providing advanced threat intelligence capabilities. Built to address the evolving landscape of cyber threats, the TIP empowers security teams with actionable insights to proactively detect, mitigate, and respond to potential security incidents.
- Curated catalog of popular OSINT Threat feed sources.
- Integration of premium feeds to enhance threat intelligence.
- Capability to automatically identify and extract all observables from the uploaded files.
- Granular expiration policies
- Data aggregation from diverse feeds, including STIX, MISP, JSON and more.
- Enrichment capabilities, for the removal of false positives, confidence/scoring of indicators, validation of indicators, and the addition of contextual information.
- Correlation rules for automatically establishing relationships between observables.
- Customizable threat score calculator for nuanced threat assessment.
- Integration of internal intelligence encompassing VR, SIR, Assets, Services, and CMDB.
- User-specific dashboards tailored for Threat Intel personas.
- Graphical visualization tools for comprehending Threat Intel data.
- Dedicated Threat Intel Analyst Workspace for streamlined operations.
- Threat hunting with case/task management functionalities and interactive investigation canvas
- Automated MITRE ATT&CK Technique extraction and rollup.
- Enable seamless integration with SIR and facilitate smooth data migration from Threat Intelligence within SIR to the Threat Intelligence Security Center.
- Establish notification rules to trigger alerts based on threat intelligence.
- Define data retention and cleanup policies.
- Generate and share status reports and investigation summaries using Case reports' rich text editor experience and customizable report templates.
- Domain separation support for MSSP use cases.
- Integrate with security tools using TISC API.
- Point integrations with security tools and sample flows for automated actions
- Webhook support for real-time, trigger-based notifications
- Data migration utility for migration from SIR Threat Intelligence module to TISC
New:
- RSS Feed Enhancements: The RSS feed schema, forms, and parsers now support tags, taxonomies, and expiration. Users can directly assign tags and taxonomies and link them to Threat Intelligence Library entities, improving classification and traceability.
- MITRE Extraction Rules: Automatic extraction of MITRE ATT&CK techniques is now available during feed ingestion and insight creation, enhancing threat mapping.
- Tagging Rules: Customizable automated tagging is now supported for RSS feed records.
- Vulnerability Intelligence Enhancements: The vulnerability schema now includes CVSS scores, exploit data, and remediation details. Additional support for remediations, identifiers, attributes, and vendor comments has been added. Products, CWEs, and Vendors are now entities with relationship linking.
- Core Processing Enhancements: Parent identification, de-duplication, and aggregation have been improved to prioritize the latest source updates. Duplicate source cleanup ensures greater consistency.
- New integration: Integration with Have I Been Pwned (HIBP) allows for observable enrichment.
- UI/UX Improvements: Threat Intelligence Library list views have been reorganized for easier navigation.
Fixed:
- Resolved feed migration issues.
- Updated Observable Fetch API to return readable tags and taxonomies.
- Fixed TAXII update ingestion issues.
- Addressed string size limits impacting aggregation.
- Corrected MISP re-publish ingestion.
- Fixed Splunk Add-on delta pull gaps.
Dependencies:
- Security Case Management common workspace components
- Threat intelligence support common
- Security support common
- Reporting common
- Seismic Component for ServiceNow(sn_node_map)