HawkEye CTI
The Cyber Threat Intelligence (CTI) lifecycle is a structured approach used to collect, analyze, and disseminate intelligence that can be used to enhance an organization’s cybersecurity posture. This cyclical process helps organizations proactively defend against cyber threats by providing timely, relevant, and actionable insights.
Cyber Threat Intelligence Lifecycle
Planning
Collection
- MISP Integration
Aggregates data from 72 threat feeds, amassing around 60 million IOCs to provide a broad intelligence base. - Supplementary Data Sources
Includes advisories from UAE CSC and KSA NCA CERT, along with 100+ RSS feeds from technology and cybersecurity publications. - Social Media API Feeds
Monitors key Twitter handles and Telegram channels for real-time threat intelligence and emerging trends. - Domain Registrations
Monitors Domain Registrations to identify impersonation domains at early stages.
Processing
Analysis
CTI Enrichment
- Threat Actor Profiling
Evaluate and categorize threat actors based on tactics, techniques, and procedures (TTPs) to understand their methods, capabilities, and objectives. This helps in identifying potential risks specific to each customer. - Trend Analysis
Examine intelligence for emerging trends, such as new attack vectors, malware variants, or shifts in threat actor behavior. By recognizing these patterns, customers can stay proactive against evolving threats. - Attack Surface Assessment
Map out potential vulnerabilities and points of exposure in customer environments. By analyzing this information, tailored defenses can be suggested to harden key assets. - Risk Scoring and Prioritization
Assign risk scores to analyzed threats based on factors like severity, likelihood, and potential impact on the customer. This helps prioritize response efforts based on the highest-risk threats.
Threat Hunting
- Analyst Driven Threat Hunt
Threat hunting based on Tactics, Techniques, and Procedures (TTPs) involves proactively searching for signs of adversarial activity by focusing on known methods and behaviors used by threat actors. By analyzing TTPs outlined in frameworks like MITRE ATT&CK, threat hunters can identify patterns that suggest ongoing or past compromise within a network. - Automated Threat Hunt
Automated threat hunting streamlines the process of identifying potential threats by continuously scanning artifacts like IP addresses, file hashes, domain names, and email domains against a the HawkEye Threat Database. Using automation, these artifacts are cross-checked against Indicators of Compromise (IOCs) collected from various intelligence sources, ensuring swift detection of any matches that could indicate malicious activity.
Dissemination
- Dissemination Channels
Intelligence is shared either through SOC incidents for immediate threats or daily advisories for ongoing awareness, based on the assessed impact. - Severity Tagging
Each alert or advisory is tagged with a severity level, helping recipients understand the potential impact and prioritize response accordingly. - TLP Classification
Alerts are tagged with TLP levels (White, Green, Amber, Red) to indicate the sensitivity and sharing restrictions, ensuring controlled distribution based on information sensitivity.
Feedback
CTI alerts disseminated to customers are regularly reviewed in weekly meetings. These sessions provide an opportunity to discuss recent alerts, assess the relevance and effectiveness of the intelligence provided, and adjust priorities or response strategies based on customer feedback. This collaborative approach ensures that CTI efforts are aligned with the evolving threat landscape and the customer’s specific security needs, enhancing the overall value of the intelligence service.