Narrator: In this lesson,
we will learn about indicator of compromise
or IoC sharing.
IoC sharing is the exchange of data
related to potential security threats.
This includes malicious IP addresses
or file hashes shared between organizations
to improve individual detection and response efforts.
Indicator of compromise sharing concepts
include structured threat information expression or STIX,
trusted automated exchange
of intelligence information or TAXI
and automated indicators sharing, or AIS.
STIX is a standardized language used
to represent threat information.
TAXI provides the protocol
for sharing threat information securely and efficiently.
And AIS, a US government initiative,
enables the real-time sharing of cyber threat indicators
between public and private sectors.
Let's learn more about
structured threat information expression or STIX,
trusted automated exchange of intelligence information
or TAXI and automated indicators sharing or AIS.
First, we have
structured threat information expression or STIX.
STIX is a standardized language used to represent
and communicate cyber threat information in a consistent
and structured format.
It was developed by the cybersecurity community to ensure
that threat data, such as indicators of compromise,
vulnerabilities, and attacker tactics could easily be shared
and understood between different organizations and systems.
For enterprises, STIX is important
because it is a common language to describe complex threats,
reducing confusion and improving the efficiency
of security operations.
When integrated into
an organization security infrastructure,
STIX helps improve collaboration
between teams and external partners,
making it easier
to stay updated on the latest threat intelligence
and to defend against attacks more effectively.
In practice, STIX is often integrated
with other security tools such as security information
and event management or SIEM systems
or threat intelligence platforms or TIPs.
These tools can automatically generate, read,
and process STIX, formatted data to identify
and respond to security incidents.
For example, a SIEM can take STIX data
from external sources and correlate it with internal logs
to identify suspicious behavior.
So in a financial services company,
cyber threat data about phishing campaigns can be formatted
using STIX and shared between banks.
This shared information using the standardized STIX format
allows each bank to quickly understand the threat
and implement preventative measures.
Second, we have the trusted automated exchange
of intelligence information or TAXI.
TAXI is a protocol that facilitates the secure exchange
of cyber threat intelligence over the internet.
TAXI was designed
to standardize the way threat data is shared,
ensuring that sensitive information is exchanged efficiently
and securely between organizations.
For enterprise, TAXI enables the automated sharing
of threat information without requiring manual effort,
which can greatly speed up the detection
and mitigation of threats.
By using TAXI,
companies can receive realtime updates
about emerging threats, allowing them to respond faster
and protect their networks more effectively.
TAXI can be integrated into an organization's
threat intelligence infrastructure through security tools
such as threat intelligence platforms
or SIEM systems that are TAXI compliant.
These tools can automate the retrieval
of threat intelligence from external sources using TAXI
to pull in new IoC's or other relevant threat data.
For example, in healthcare, an organization might use TAXI
to share information about new ransomware strains
targeting hospitals with other institutions in the sector.
This timely exchange
of threat intelligence allows each organization
to update their defenses
and reduce the risk of being compromised.
Third and last, we have automated indicators sharing.
AIS is a program initiated by the US Department
of Homeland Security that facilitates the real-time exchange
of cyber threat indicators between public
and private sector organizations.
AIS is designed to improve national cybersecurity
by allowing organizations to share IoC's
such as malicious IP addresses, file hashes,
or domain names at machine speed.
For enterprise, participating in AIS is important
because it provides access
to up-to-date threat information
from a wide range of sources,
including government agencies and other private companies.
This allows organizations
to proactively defend against the latest threats
and helps to create a more unified
and resilient cybersecurity ecosystem.
AIS can be integrated into an organization's
threat intelligence workflow
through security automation tools
and platforms that support AIS feeds.
For example, a SIEM or threat intelligence platform
might be configured to receive AIS data
and automatically cross-reference it
with internal security logs to identify potential threats.
So let's consider a critical infrastructure company
such as an energy provider using automated indicator sharing
to receive real-time updates about cyber threats
targeting the energy sector.
By swiftly identifying relevant threat indicators
shared through AIS,
the company can enhance its defenses
and prevent potential disruption to essential services.
Now let's do a demo showcasing
how to retrieve threat intelligence data
from Alien Vault OTX
in a structured format that can be easily read
and integrated into security workflows.
While we pull threat intelligence data from Alien Vault OTX,
we will focus on retrieving the data in a structured
and a readable format.
Instead of using the TAXI protocol,
which Alien Vault OTX does not support
in the standard 2.0 configuration,
we will access the threat intelligence
through Alien Vault's REST API.
This will allow us to interact directly with OTX
and pull indicators of compromise such as IP addresses,
URL's, domains, and file hashes,
which are used for detecting and mitigating threats.
By using REST API calls
and specific headers for authentication, we will be able
to securely retrieve data that will be ready
for integration into security analysis workflows.
Let's start here in the command line
by creating a REST environment.
Now let's activate that environment.
Within our environment
and the script that we're going to write,
we're going to want the requests module, so let's go ahead
and install it in this environment.
To make our output more user-friendly,
we will employ several formatting techniques.
Here, we will use JSON Pretty Printing,
a method that organizes data in a hierarchical structure
with indentation making it much easier to read.
This is particularly helpful when dealing
with large data sets as it enables analysts to quickly scan
for relevant information without getting overwhelmed
by raw unformatted text.
For ease and ongoing analysis, we'll save our output
to a file for storage.
Saving the data as a JSON formatted file
also provides a structured format
that can be accessed by other tools
or imported into visualization
and analysis platforms, adding flexibility to our workflow.
Now let's create a script that will pull data
and format it in a JSON format.
We'll call our script Discover_Rest.py.
I've got the script over here
on the right side of the screen.
I'll just highlight it and put it into our file.
You can see that we are going to need an API key
for Alien Vault OTX, which I do have created
and I'm logged into right now.
I'll grab the key and we'll put it straight into the script.
Now let's save the script.
Okay, next, all we need to do is run it
and we'll run it with the python3 discover_rest.py command.
All right, it's running in the background right now.
It ran the script,
pulled the data from the Alien Vault OTX
and saved the data in the OTX_indicators.JSON file.
Let's take a look at it.
There we go.
As you can see, it's in JSON format
and we can see things like malicious MD5 file hashes.
If we scroll up, we'll see some domain names
and if we scroll up a little bit farther,
we'll probably see some IP addresses.
There we go.
There's some malicious IP addresses.
So while Alien Vault OTX does not directly output data
in STIX format via its API, tools and scripts
can be adapted to reformat the data if STIX is required
for integration into security operations and platforms
that would depend on this structure.
So all we would need to do to convert the data
to a STIX format is write another script.
This demonstration illustrated how to pull, format,
and prepare threat intelligence data
from a widely used source, providing a practical solution
for integrating indicators of compromise
into cybersecurity workflows.
This approach can be further adapted to suit the needs
of specific security infrastructures,
making it a versatile solution
for gathering actionable intelligence.
So remember, indicator of compromise sharing
is the exchange of data related to
potential cybersecurity threats between organizations.
This data can include things like malicious IP addresses,
file hashes, or domain names, which help improve detection
and response efforts.
Key concepts in indicator of compromise sharing are STIX,
TAXI and AIS.
STIX is a standardized language
used to represent threat information while TAXI
provides a protocol for securely sharing the information.
Finally, AIS, a government initiative,
enables real-time sharing of cyber threat indicators
between public and private sectors,
enhancing overall cybersecurity defenses.