How to Create Effective Structured Intelligence Extensions for TIPs
summary
Practical guide to building TIP extensions that normalise and route CTI: uses STIX concepts and a real EclecticIQ-style platform, implements feeds, targeted collection queries and enrichers, and measures success by deduplication, ingest latency and usable relations. Uses composite identifier (type+ip+malware+timestamp+source) to avoid false dedupe, flattens thousands of observables into meaningful hashes/domains, maps confidence scores (1–100) to tiers, leverages use platform tagging rules and insists granular enrichers answer a single question.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:20Aim of the Talk
- 2:32What is a TIP?
- 3:22What is Structured Threat Data?
- 4:18What are Extensions?
- 5:52Define Your Data Model
- 6:47The Data Life Cycle
- 9:42Source Data Including IDs
- 13:00Targeted Collection
- 15:28How to Fix - Making Assumptions on Data
- 17:39Leverage Platform Automation Capabilities
- 20:49Consistent Classification
- 22:44Extension Tips for Dissemination
- 23:47Granular Enrichers
related talks
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing
29mA Collective CTI Doctrine
30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard Ecosystem
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTW
01h 01mIntroduction To STIX/TAXII 2 Standards
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence