Game Changer Platform for automating Threat intel Workflows
Use Cases and Deployment Scope
In MSSP environment we use ThreatConnect TIOP as the central hub for all threat intelligence-related operations, while platform is integrated into our workflows for triaging alerts, enriching alerts, enriching IOCs, correlating data across client environments and triggering automated response actions we ingest threat intel from various open sources and while using ThreatConnect to normalize,enrich and prioritize this data
Pros
- One of the most beneficial features of the ThreatConnect is its ability to automatically enrich IOCs from multiple sources such as VT WHOis and assign a dynamic threat score.
Cons
- while playbooks are powerfull but building and troubleshooting complex workflows can be time consuming there is lack of guide and the documentation for common use cases.
Return on Investment
- Tool has clear and positive impact on our overall SOC oprerations and business objectives as an MSSP one of the most significant gains has been operational effeciency, by automating IOC enrichment and threat scoring and time analyst to reduce MTTD and MTTR across multiple enviroment.
