Hi All,
Can someone please clarify how custom IOC data is stored in the SecOps?
I am coming from Splunk ES, where IOC indicators are stored in KVStore as simple lookup lists.
However, when setting up third-party API feeds for IOC ingestion (Anomali) the data is ingested into SIEM with time dimension. (e.g. graph.metadata.vendor_name = "ANOMALI_IOC" over last 30 days gives 30 matchies for the same IOC).
Wouldn’t it make more sense to store IOC as timeless data?
Thanks!
+17IOC data in the form of IPs, for example, is timed as attributes like ownership and whether or not they are malicious can change. As they are timed, an event's timestamp needs to fall between an IOC record's start and end times for a match. With a timeless list, an IP that was harmless 20 days ago and is flagged today would also flag the old traffic. The time window prevents that.
Additionally, IOCs in the form of hashes for example, will be timeless as they will not change the way an IP may. https://docs.cloud.google.com/chronicle/docs/event-processing/entity-graph#timed-vs-timeless-google-threat-intelligence-data-sources
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
