CTI: Integrating Threat Intelligence into Your SOC

Cyber Threat Intelligence (CTI) is the discipline that transforms raw threat data into actionable intelligence. Yet too many SOCs collect feeds without effectively leveraging them. Here is a practical guide to integrating CTI into your security operations.

Threat Intelligence levels

CTI is organized into three complementary levels:

• Tactical: technical indicators (IoCs), malicious IPs, malware hashes, C2 domains, phishing URLs. Automatically consumed by detection tools

• Operational: attacker TTPs (Tactics, Techniques, Procedures). How they operate, what tools they use, their modus operandi. Reference: MITRE ATT&CK

• Strategic: macro trends, group motivations, geopolitics. Aimed at decision-makers (CISO, executive leadership)

STIX 2.1 and TAXII: exchange standards

STIX (Structured Threat Information eXpression) is the standard format for representing CTI objects: indicators, malware, campaigns, threat actors, vulnerabilities. Version 2.1 (OASIS) supports complex relationships between objects and opinions (scoring) on indicators.

TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol. It defines how CTI feeds are published and consumed via collections and channels. The STIX + TAXII combination enables interoperability between platforms (MISP, OpenCTI, ThreatConnect, Anomali).

Essential CTI feeds

Institutional sources

• CERT-FR (ANSSI): French security alerts and advisories, indicators linked to threats targeting France. Essential reference for French organizations

• CISA KEV (Known Exploited Vulnerabilities): catalog of actively exploited vulnerabilities, maintained by the US CISA agency. Mandatory remediation for US federal agencies, best practice for all

• NVD (National Vulnerability Database): comprehensive CVE database with CVSS scoring

Scoring and context sources

• EPSS (Exploit Prediction Scoring System): probability that a CVE will be exploited in the next 30 days. Far more actionable than CVSS alone for prioritization

• GreyNoise: identifies Internet "noise" (mass scanners, benign bots) to reduce false positives. If an IP is identified by GreyNoise as a mass scanner, it is probably not a targeted attack

• CrowdSec CTI: collaborative malicious IP database, fed by the CrowdSec community (100,000+ installations). Scoring by behavior and reputation

• AbuseIPDB: abusive IP report database, useful for IP reputation scoring

TLP: the Traffic Light Protocol

TLP defines information sharing conditions:

• TLP:RED: strictly confidential, named recipients only

• TLP:AMBER+STRICT: sharing limited to the recipient's organization

• TLP:AMBER: extended sharing to clients and partners who need the information

• TLP:GREEN: sharing within the cyber community, no public disclosure

• TLP:CLEAR: no distribution restrictions

Respecting TLP is a prerequisite for participating in CTI sharing circles (ISACs, sector CERTs, trust communities).

IoC scoring: avoiding overload

An average SOC receives thousands of IoCs per day. Without scoring, it is unusable. A pragmatic scoring approach combines:

• Source reliability: a CERT-FR IoC carries more weight than an unverified community feed

• Freshness: an IoC older than 30 days has a drastically reduced probability of still being active

• Context: an IoC associated with an APT group targeting your sector is more relevant than a generic IoC

• Corroboration: an IoC present in 3+ independent feeds is more reliable than an isolated IoC

ThreatClaw: 26 built-in CTI enrichments

ThreatClaw natively integrates 26 CTI enrichment sources in its skills engine:

• Automatic querying of VirusTotal, AbuseIPDB, GreyNoise, Shodan, CrowdSec CTI, OTX AlienVault

• Correlation with the CISA KEV catalog and EPSS scores

• Real-time CTI context enrichment of SIEM alerts

• Automatic IoC scoring with multi-source weighting

• False positive detection through GreyNoise cross-referencing

The agent does not just collect IoCs: it contextualizes them relative to your environment and makes blocking or alerting decisions accordingly.

FAQ

Where should I start with CTI?

Start with high-quality free feeds: CERT-FR, CISA KEV, EPSS. Integrate them into your SIEM or your ThreatClaw agent. Then add GreyNoise (free community version) for noise filtering. This is a solid foundation that costs nothing.

MISP or OpenCTI?

MISP is historically the reference CTI sharing platform (developed by the Luxembourg CERT). OpenCTI (Filigran) offers a more modern interface and a richer data model (native STIX 2.1 based). For a mature SOC, OpenCTI is recommended. For community sharing, MISP remains essential.

How do you measure CTI value?

Three key metrics: CTI-attributable detection rate (alerts triggered by IoCs), mean time to detect (MTTD) before/after CTI integration, and false positive rate reduction through contextual scoring.

Does ThreatClaw support STIX/TAXII?

Yes. ThreatClaw can ingest STIX 2.1 feeds via TAXII and export its own observations in STIX format. This enables integration with MISP, OpenCTI, and any compatible ecosystem. Check our plans for integration details.