Threat Intelligence Platform
This package is designed to detect security threat based on intelligence data feed from open source Malware Information Sharing Platform (MISP). It also follows MITRE ATT&CK framework.
This package requires installation of MIC for MISP. For more information on MIC, please refer to the documentation at https://community.microfocus.com/t5/ESM-and-ESM-Express/Model-Import-Connector-for-MISP-Malware-Information-Sharing/ta-p/2752381
Following use cases are covered in this package:
- Botnet Activity
- Dangerous Browsing
- Internal Asset Found in Reputation List
- Phishing
- Ransomware
- Suspicious Activity
- Suspicious DNS Query
- Suspicious Email
- Suspicious File Hash
Following MITRE ATT&CK Techniques are covered as well:
- T1192-Spearphishing Link
- T1219-Remote Access Tools
- T1486-Data Encrypted for Impact
Security Threat Monitoring:
This package monitors security threats based on security log events from firewall, IDS/IPS, OS, Application, Scanner, Anti-Virus etc.
Following use cases are included in this package:
- Application Monitoring
- Entity Monitoring
- Host Monitoring
- Malware Monitoring
- Network Monitoring
- Perimeter Monitoring
- Vulnerability Monitoring
Following MITRE ATT&CK Techniques are covered as well:
- T1189-Drive-by Compromise
- T1190-Exploit Public-Facing Application
- T1098-Account Manipulation
- T1136-Create Account
- T1068-Exploitation for Privilege Escalation
- T1089-Disabling Security Tools
- T1110-Brute Force
- T1075-Pass the Hash
- T1210-Exploitation of Remote Services
- T1483-Domain Generation Algorithms
- T1489-Service Stop
- T1498-Network Denial of Service
281 items
19 item
45 item
1 item
14 item
11 item
42 item
1 item
32 item
11 item
28 item
17 item
1 item
90 item
