🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Incident Response › Lesson 11
TEC-CYBE44-07 · Lesson 11 · 14 clock hours · lab

Threat Intelligence Integration and IOC Sharing

Objective. Students will ingest structured threat intelligence feeds into a SIEM or threat intelligence platform and use IOCs to enrich an active incident investigation.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is Threat Intelligence and Why Does It Matter?

Threat intelligence is analyzed information about adversary capabilities, infrastructure, and intentions that helps defenders make faster, better decisions. Raw data — a list of IP addresses, for example — is not intelligence until it has been processed, contextualized, and validated. During an active incident, enriching your findings with current threat intelligence can confirm attribution, reveal additional compromised systems, and accelerate containment.

Information Sharing and Analysis Centers (ISACs) are sector-specific organizations (financial, healthcare, energy, etc.) that distribute vetted threat intelligence among member organizations. Sharing through an ISAC multiplies the defensive value of every indicator your organization discovers, while consuming shared indicators from others extends your visibility beyond what your own logs can show.

Indicators of Compromise (IOCs)

An IOC is an observable artifact that signals a system may be compromised. Common IOC types include:

Not all IOCs age equally. IP addresses rotate frequently and may belong to shared hosting; acting on a stale IP can produce false positives or miss an evolved campaign. Behavioral indicators derived from adversary tactics tend to remain valid longer because changing behavior is more costly for attackers than spinning up a new IP.

STIX and TAXII: The Standards Behind IOC Sharing

STIX (Structured Threat Information eXpression) is a JSON-based language for describing cyber threat intelligence objects — threats, campaigns, malware, indicators, courses of action, and relationships between them. STIX 2.x is the current version and is used by MISP, commercial platforms, and government feeds.

TAXII (Trusted Automated eXchange of Indicator Information) is the transport protocol that moves STIX bundles between servers and clients over HTTPS. Think of STIX as the language and TAXII as the delivery truck. A TAXII server exposes collections; a client authenticates and pulls or subscribes to bundles.

Together, STIX/TAXII enable machine-readable, automated IOC sharing at scale — replacing slower, error-prone manual processes like emailing CSV spreadsheets.

MISP: Open-Source Threat Intelligence Platform

MISP (Malware Information Sharing Platform) is a free, open-source threat intelligence platform maintained by the CIRCL community. It can:

In this lab you will either connect to a simulated TAXII feed or import a sample STIX bundle directly into MISP, then push resulting IOCs to the lab SIEM.

Ingesting IOCs Into a SIEM

Once MISP exports IOCs, the SIEM must be configured to consume them. The general workflow is:

1. Export IOCs from MISP in a format the SIEM accepts (CSV lookup table, JSON feed, or native integration).

2. Create or update a lookup list/watchlist in the SIEM populated with those IOCs.

3. Write correlation rules that join incoming log events against the lookup: `source_ip IN threat_feed_ips` or `dns.query IN threat_feed_domains`.

4. Set alert priority based on IOC confidence and TLP marking.

5. Schedule regular refresh so the lookup stays current.

Test your rule by replaying a log event that contains a known IOC from the feed. If the rule fires, the pipeline is working.

MITRE ATT&CK Framework for IOC Contextualization

MITRE ATT&CK is a publicly available knowledge base of adversary tactics (the why) and techniques (the how). Mapping IOCs and observed behaviors to ATT&CK IDs:

The ATT&CK Navigator is a free, browser-based tool that lets you annotate the ATT&CK matrix with colors and notes. During this lab you will highlight techniques observed in a previous scenario, record the ATT&CK IDs (e.g., T1566.001 for Spearphishing Attachment), and identify at least two mitigations per technique from the ATT&CK website.

Sharing IOCs: Value and Risk

Sharing benefits the entire community but carries risk. Key considerations:

Behavioral IOCs (ATT&CK-mapped TTPs) are generally safer to share than raw IPs because they carry less personal data and degrade more slowly.

Lab Safety and Data Handling

All lab work uses isolated virtual environments and sample/simulated data only. Never connect lab tools to live production SIEM instances or real organizational feeds without explicit written authorization. Handle any sample data that includes realistic-looking personal information (names, IPs from real ranges) as if it were sensitive — do not post it publicly or share it outside the lab network. Follow your program's acceptable-use policy for all cloud-based tools including the ATT&CK Navigator.

Key terms9

IOC (Indicator of Compromise)An observable artifact — such as a malicious IP address, domain, file hash, or behavioral pattern — that provides evidence a system may have been compromised.
STIX (Structured Threat Information eXpression)A standardized JSON-based language for representing cyber threat intelligence objects and the relationships between them, enabling machine-readable sharing.
TAXII (Trusted Automated eXchange of Indicator Information)An HTTPS-based transport protocol used to push or pull STIX bundles between threat intelligence servers and clients automatically.
MISP (Malware Information Sharing Platform)A free, open-source threat intelligence platform that stores, tags, and shares IOCs and supports STIX/TAXII ingestion and export.
MITRE ATT&CKA publicly available knowledge base that catalogs adversary tactics (high-level goals) and techniques (specific methods), each assigned a unique ID, along with documented mitigations and detections.
ISAC (Information Sharing and Analysis Center)A sector-specific membership organization that facilitates sharing of vetted threat intelligence among organizations in a given industry such as finance, healthcare, or energy.
TLP (Traffic Light Protocol)A set of four color-coded markings (WHITE, GREEN, AMBER, AMBER+STRICT, RED) that govern how shared threat intelligence may be redistributed by recipients.
Correlation RuleA logical condition configured in a SIEM that joins incoming log events against reference data (such as an IOC watchlist) and generates an alert when a match is found.
ATT&CK NavigatorA free, browser-based tool provided by MITRE that allows analysts to annotate the ATT&CK matrix to visualize technique coverage, gaps, and incident timelines.
In class: Import a STIX/TAXII feed (using a free MISP community instance or simulated feed) into the lab SIEM, then write correlation rules that alert when a logged IP or domain matches an IOC from the feed. · Using the MITRE ATT&CK Navigator, map the tactics and techniques observed during a previous lab scenario to ATT&CK IDs, then identify two defensive mitigations for each identified technique. · Share a set of IOCs in a standardized format (CSV or STIX JSON) as a group exercise simulating information sharing with an ISAC; discuss the value and risks of sharing specific IOC types (IP vs. domain vs. behavioral).
Materials: MISP (open-source), MITRE ATT&CK Navigator (browser-based, free), sample STIX/TAXII feed files, lab SIEM instance, ATT&CK worksheet
Check: Instructor verifies ATT&CK mapping worksheet covers at least 5 correctly identified techniques with corresponding mitigations; SIEM correlation rule must fire on a test IOC match to pass.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — Threat Intelligence and Threat Hunting
1. An analyst exports IOCs from MISP and loads them into the lab SIEM as a lookup table. A correlation rule is written so that an alert fires whenever a source IP in a firewall log matches an entry in the lookup. Which two standards are most directly involved in the original ingestion of those IOCs into MISP?
CompTIA CySA+ — Threat and Vulnerability Management
2. A security analyst is mapping an observed phishing email campaign to the MITRE ATT&CK framework. The emails contained a malicious attachment that executed a macro. Which ATT&CK tactic best describes the initial phase of this activity?
CompTIA CySA+ — Security Operations and Monitoring
3. Your organization wants to share newly discovered C2 domain IOCs with sector partners through an ISAC. A colleague suggests sharing the IOCs immediately without review. Which risk most directly argues against immediate, unvalidated sharing?
ISC2 CC — Security Operations
4. An analyst reviews a STIX bundle and finds an indicator object with a TLP:AMBER marking. According to Traffic Light Protocol, how should this indicator be handled?
CompTIA CySA+ — Threat and Vulnerability Management
5. Which type of IOC tends to remain actionable the longest after a threat campaign is first observed, and why?
CompTIA CySA+ — Security Operations and Monitoring
6. During the lab, a correlation rule fails to fire when a test log event containing a known malicious IP is replayed through the SIEM. Which troubleshooting step should the analyst perform first?
CompTIA Security+ — Threat Intelligence and Threat Hunting
7. A student maps a ransomware incident to MITRE ATT&CK and identifies the technique 'Data Encrypted for Impact.' Which ATT&CK tactic does this technique fall under?
CompTIA CySA+ — Threat and Vulnerability Management
8. An organization receives a STIX bundle containing IOCs from a partner. Before ingesting the bundle into their SIEM, the security team should perform which action to maintain data quality?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →