Using Threat Connect to create a Threat Intel dashboard

Threat Connect Overview

Threat Connect focuses more on the information and new developments within cybersecurity and the threat landscape and connecting the landscape with indicators. This intelligence can help your team make better-informed decisions on what to prioritize. Threat Connect would fall under the tactical type of threat intelligence.

There is a free and open-source version of Threat Connect available but if you were actually using this on a security team you would want to pay for access to the full platform. Threat Connect is a very large platform with many capabilities but we will only be using it to create our threat intel dashboard and gather indicators from other ISACs like AlienVault OTX. It is important to have multiple sources for the information or intelligence that you collect.

Sign up for a free ThreatConnect account here.

Creating a Threat Intel Dashboard

Straight out of the box Threat Connect comes with a pre-configured dashboard you can use, as well as 4 other more specific dashboards: Operations Dashboard, Source Analysis, OSINT Overview, and Covid-19 Related Activity.

We will only be covering the default dashboard in-depth but feel free to play with other dashboards as much as you want to get familiar with them as well as the other features ThreatConnect has.

Breaking Down the Dashboard

We can break up the various sections of the dashboard to make it more digestible and see what each section has to offer.

• Top Sources by Observations

This section sorts observations or indicators by the owner or source of the observation. This is helpful to find reliable sources for intelligence as a majority of threat intel is community-driven.

• Latest Intelligence

Gives the latest intelligence that has been reported to the platform. This can be helpful if you want to stay on top of the newest rising threats.

• Top Sources by False Positives

Similar to the Top Sources by Observations this will sort the owners by who has the most false positives. This can be useful to stay away from indicator owners who generate a lot of false positives and their intel may not be as high quality.

• Top Tags

This is a collection of the top tags used to categorize indicators. This can be useful to quickly find a topic or to identify trends within the threat landscape.

• Indicator Breakdown

A breakdown of all of their intelligence combined and what indicators make up the platform. This is not super helpful for most applications as it only gives a brief overview of the platform as a whole.

For the most part, the other sections of the dashboard could be ignored as they are just overviews of what is on the platform rather than specific threat intelligence.

Custom Dashboards

You can use all of these various parts of the default dashboard to create your own personalized dashboard that fits your liking.

For example, this is part of the Operations Dashboard I like to use.

Note: Threat Connect can go far beyond your normal ISAC including Incident Response Playbooks, Graphs, etc. However, these features are only available in the paid version. Let's move on to using Alienvault to gather a collection of IOCs.