>> Hello, this is Alyssa Berriche.
Welcome again to the Advanced
Cyber Threat Intelligence course.
This is the first molecule data collection.
First lesson: what is data collection?
In this video, we will deep dive into data collection.
We will start with defining what is data collection,
and then we will detail
the different types of data collection sources.
Now, let's start the definition of collection.
Collection is the process of gathering
data and information to address
intelligence requirements and
objectives that were defined
during the planning and direction phase
of the intelligence lifecycle.
The data collected can be
a finished intelligence like
intelligence reports from vendors or
reports from cybersecurity blocks or
raw data from different sources of logs like firewall,
endpoints, IPS, etc,
or dumps, for example, a paste website.
I have a three recommendation about data collection.
The first one is,
in order to get a full picture about threats,
collecting data from one source is not sufficient.
Basically, the more data you collect,
the more evidence you
will get in order to make assessment.
But hold on,
data needs to be relevant, otherwise,
these can slow down
your investigations and cause knowledge gaps.
So quality matters as much as quantity.
Data collection is also a time-consuming task,
so my recommendation here is automation.
Automate as much as you can from the collection phase,
so you can save a lot of time for vetting and analysis.
Now, let's move to the types of collection sources.
I can divide the collection sources into
two big categories: internal data
sources and external ones.
Let's start with the internal sources.
We can find different types of internal sources.
We can find logs or more known as raw data.
Also vulnerability scan results.
We can also find
network capture tools or internal databases.
We can also find internal threat reports from
previous investigations or indicators
of compromises or IOCs.
Save it into SEM or
threat intelligence platform or even flat databases,
and store it from
previous investigations or previous cases.
For the external sources,
there are a lot of types.
We can say there are thread data feeds,
OSINT, social media,
cyber security blogs and threat reports shared
by security experts or security vendors,
threat actor, forums, and the dark web.
Let's summarize this video.
This is the first lesson in
the first module, data collection.
We started with defining data collection phase,
then the different categories of collection sources,
and then we gave some recommendations about
data collection like collecting
data from one source is not sufficient.
Quality matters as much as quantity,
and automation can save a
>> lot of time for analysis phase.
>> This is it for this video.
In the next video, we will dig more into
the internal data sources. See you there.