Threat Intelligence Platforms (TIP) act as threat consolidators and the first level of analysis for a security team and must incorporate external threat intelligence feeds. The best TIP tools enable at least four of the following five capabilities:
Connect to external threat intelligence feeds that reflect the latest information on malware, threat actors, and vulnerabilities; this data can come in the form of malicious IP addresses, domains, file hashes, etc.
Connect to internal systems such as endpoint detection and response (EDR) tools, firewalls, and network monitoring tools to track internal information on malicious or anomalous activity
Matches feed data between internal alerts and externally identified indicators of compromise
Enable quick rapid assessments with prioritized risk assessments, alerts, analysis tools, or smart data visualization
Enable other security tools such as next generation firewalls (NGFW), secure gateways, or intrusion detection and prevention systems (IDPS) that use the information from threat feeds to detect and block malicious activity and traffic