Threat Intelligence

Overview

Threat Intelligence is a core component of the Secure60 platform, applied to detect, prevent and respond to cyber threats. We offer two main types of Threat Intelligence:

1. Built-in Threat Intelligence
2. Third-party Threat Intelligence

We support both options to ensure comprehensive coverage and flexibility for your security needs.

Built-in Threat Intelligence

Our Built-in Threat Intelligence draws on a combination of open-source and private data sources to provide a broad foundation of threat information. This includes:

• Open Source Data Sources: Leveraging publicly available threat intelligence feeds, we apply filtering to ensure accuracy and freshness which ensures accurate and up-to-date information on emerging threats.
• Private Data Sources: Utilizing proprietary data sources to enhance threat detection and enrich the overall intelligence.

Features

• Comprehensive Coverage: Aggregates data from multiple open source and private sources.
• Real-time Updates: Continuously updated to reflect the latest threat landscape.
• Smart Analytics: Remove false positives through automated analysis of packet sizes, protocol types and more
• Customizable: Allows for tailored threat intelligence based on your specific requirements.

Third-party Threat Intelligence

We also integrate with external Threat Intelligence providers to offer an additional layer of security. This integration allows you to benefit from the expertise and resources of leading threat intelligence services.

Supported Providers

We support integration with various third-party Threat Intelligence providers, contact support with details of the specific provider you want to enable to have this activated.

Features

• Enhanced Security: Access to a wider range of threat intelligence data from specialized providers.
• Third-party integration: Connect third-party threat intelligence services to the platform.
• Scalability: Supports scaling your threat intelligence capabilities as your security needs grow.

Getting Started

To start using Threat Intelligence in Secure60, follow these steps:

1. Enable Built-in Threat Intelligence:

   • Threat Intelligence is enabled on each Project by default
   • To managed settings, Navigate to the Threat Intelligence settings in the Secure60 portal (Project Settings page under “Modules”)
   • You can tune features such as score of Threats detected, Adding items to Allow Lists and more

2. Integrate Third-party Threat Intelligence:

   • Contact Secure60 Support with details of your specific provider and we will enable on your Secure60 account.

Related

When an indicator matches your data, Threat Intelligence raises a Threat (source label Threat Intelligence) on the Threats Overview. For how those threats are then triaged, responded to, and reported on alongside every other source, see Threat Management.