Threat Intel Management use cases - Administrator Guide - Threat Intel Management Guide - 8 - Cortex XSOAR - Cortex - Security Operations

In this example, Firewall Admins are responsible for ensuring employees can always access SaaS applications such as Zoom and Office 365. They need to manage a stream of inbound change requests from the security team and other business units. Regardless of these daily changes, critical apps must always be allowed. The network infrastructure of SaaS applications is constantly changing/rotating IP addresses and Domains.

The security team needs to leverage threat intelligence to block known bad domains, IPs, hashes, etc (indicators). The indicators are being collected from many different sources which need to be normalized, scored, and vetted (ensure not blocking business partners) before pushing to security devices such as Firewalls for blocking.

Incident Responders are receiving an endless stream of alerts, usually with little to no context of the external threat. Enriching alerts with curated threat intelligence from Unit 42 enables analysts to see the bigger picture and make more informed decisions when responding to alerts, ensuring comprehensive containment of the threat.

For example, configure the Palo Alto Networks Cortex XDR Investigation and Response integrations to ingest alerts from Cortex XDR. In the incidents page, open an incident from Cortex XDR. In the Case Info tab, you can see brief information, such as affected hosts, and affected users. In the Investigation tab, you can view the alert file artifacts or network artifacts. You can deep dive into the indicator by viewing the summary (verdict, sources, related incidents, timeline relationships, etc). In the Unit 42 Intel tab you can get additional details from Unit 42. For a file, you can see static and dynamic analysis. In the Work Plan, a playbook was run on whether an investigation is needed.

A new critical vulnerability is disclosed to the public which impacts the world's most popular applications (e.g. Log4J). The security team has already begun the search for the vulnerable software, however, the threat intel team needs to inform all technology employees of this critical threat. The intel team crafts a brief report summarizing the threat and adds analysis describing why this threat is relevant to the organization. This is also a great way to “advertise” the availability of threat intelligence services across the organization.

In this example, you want to create a flash intel report about the Log4j security vulnerability, which will be sent to all internal stakeholders. You want to include the impact on the business with a brief analysis.

The security team needs to perform due diligence, ensuring the organization has not been impacted by newly collected intelligence. Querying historical log data is a slow and tedious process for analysts (after acquisitions, organizations have multiple log stores). Additionally, running taxing historical queries is not possible during working hours, as compute resources are prioritized for SOC operations. The security team needs to automate this task during non-peak hours.