An MSSP decorates customer alerts with a feed of adversary addresses and malware hashes. Which term names that feed and the way it is being used?
Select an answer to reveal the explanation.
Short Explanation
A weather report is not the same thing as walking the field yourself. You are decorating alerts with an outside feed of addresses and hashes, and that feed is threat intelligence. Hunting your own logs, taking a binary apart, and rating the customer gaps are other jobs.
Full Explanation
Threat intelligence here is outside knowledge about adversaries and their malware, applied to alerts the MSSP already has. Threat intelligence: an external feed of addresses and malware hashes applied to alerts, is the term for that decoration. Threat hunting: a search of the MSSP's own telemetry with no new external feed added, is a search of data the provider already holds, and this task starts by adding a feed. Reverse engineering: taking a malware binary apart to learn how its code behaves, inspects a sample and does not describe a feed of addresses and hashes. Risk assessment: rating the customer's own gaps rather than decorating alerts from outside, scores the customer's weaknesses and does not attach external indicators to alerts. Decorating an alert with an outside indicator does not require taking a sample apart or scoring residual risk. Exam caveat: a feed can later inspire a hunt, but applying the feed to alerts is intelligence use, not the hunt itself. Operational check: record the feed source and the indicator type, address or hash, on the alert so the decoration can be traced.