Automated Network Defense through Threat Intelligence and Knowledge Management

In order for threat intelligence to be leveraged effectively within organizations it must bewell structured and enriched. These tasks are relatively trivial to accomplish but tend tobe conducted ad-hoc or, worse still, manually. This paper sets out to demonstrate thatautomation and appropriate structuring of threat intelligence need not be prescriptive norexpensive. With current open source tools and languages an organization candramatically increase the value of their threat intelligence through automated enrichmentand fusion between the tactical and strategic sources, providing tangible networkdetection capability whilst answering broader contextual questions. This is achieved byusing bulk data feed resource and open source reporting, processed using the openarchitecture STIX threat intelligence structures and deployed to test mechanisms usingBro and SNORT. The outcome is a network alerting capability that not only tells us whensomething that we already know has happened, but potentially who did it as well.