>> We're now going to proceed with
Module 3 of the ATT&CK CTI training course.
This module is going to focus on learning how to
store and analyze ATT&CK-Mapped Data.
We'll have a total of four lessons for this module.
The first lesson will be 3.1,
which we'll learn how to store and
display ATT&CK-Mapped Intel.
The second lesson, 3.2,
we'll focus on showing you how to
express ATT&CK-Mapped Intel.
The third lesson, 3.3,
we'll learn how to analyze this data.
Lastly, Lesson 3.4 is more of a walk-through on
the hands-on exercises you'll be
doing with the ATT&CK Navigator tool.
As we just said, this lesson,
we'll be focused on learning how to store and display
ATT&CK-Mapped Intel. Let's get started.
Our objectives for Lesson 3.1,
are first to consider who or
what will be consuming the mapped Intel.
Second is to identify
the most effective storage platform
for our environment and requirements.
When we first talk about storing ATT&CK-Mapped Intel,
we have several things that we need to consider.
The first is, who is consuming this intelligence?
Is it a human analyst?
Is it a machine taking the data to a Sim,
who is interpreting the data will
determine how we represent and store it.
The next is what are our intelligence requirements?
When we're thinking in terms of adding
contextual meaning to something,
we need to determine if the full text is needed or just
components that can describe it
in a meaningful or productive way.
After we establish the requirements,
we can then think of how detailed we want them to be.
Do we want to just include the parent techniques?
Do we want some techniques for more depth?
Or do we also want a procedure to provide
the example of how the technique is used as well?
The next thing we want to consider is
how we'll capture this level
of detail and when it's captured in a specific format,
how will that allow us to link it to
other intelligence for our CTI needs?
Lastly, we'll need to consider how
this data will be imported and exported,
and specifically what format it will be in.
Will it be an XML, JSON, etc?
Here you have a screenshot
showing how some techniques are even
represented and referenced on Wikipedia pages.
Take a look at the right-side panel of the page shown
here and you can see how the techniques
scheduled task mask back to
the attack framework and how it's
displayed with the appropriate metadata,
such as the technique ID,
the tactic, the platform, and so on.
Here we have a screenshot of another useful CTI tool for
tracking and sharing indicators of
compromise and threat
intelligence within your organization.
MISP is an open-source threat
intelligence platform for sharing, storing,
and correlating these IOCs for
targeted attacks, threat intelligence,
financial fraud information, vulnerability information,
or even counterterrorism threats.
It allows you to store data in a structured format,
allowing for automated use of their database with
an extensive support of
cybersecurity indicators as flexible,
import and export features as well to help you
share that data within your organization.
Here we have another slide showing
the MISP tool and an example of
how we can store and display
attack math threat intelligence.
MISP is a great tool
for sharing your threat intelligence between
teams across your organization
in a streamline and simple way.
It also allows you the ability to
link indicators as well as supplemental
files and materials that can help bring
together an investigation for your CTI needs.
In Lesson 3.1, we learned about
the different ways that we can consume,
link, contextualize,
and import and export ATT&CK-Mapped Intel.
We also learned about the
>> different options that we have
>> for our storage platform environment and requirements.