diff --git a/README.md b/README.md index 5d2431c..4940eeb 100644 --- a/README.md +++ b/README.md @@ -273,7 +273,7 @@ A certain amount of (domain- or business-specific) analysis is necessary to crea SANS ICS Suspicious Domains - The Suspicious Domains Threat Lists by SANS ICS tracks suspicious domains. It offers 3 lists categorized as either high, medium or low sensitivity, where the high sensitivity list has fewer false positives, whereas the low sensitivty list with more false positives. There is also an approved whitelist of domains.
+ The Suspicious Domains Threat Lists by SANS ICS tracks suspicious domains. It offers 3 lists categorized as either high, medium or low sensitivity, where the high sensitivity list has fewer false positives, whereas the low sensitivity list with more false positives. There is also an approved whitelist of domains.
Finally, there is a suggested IP blocklist from DShield. @@ -434,7 +434,7 @@ Standardized formats for sharing Threat Intelligence (mostly IOCs). VERIS - The Vocabulary for Event Recording and Incident Sharing (VERIS) is a set of metrics designed to provide a common language for describing security incidents in a structured and repeatable manner. VERIS is a response to one of the most critical and persistent challenges in the security industry - a lack of quality information. In addition to providing a structuref format, VERIS also collects data from the community to report on breaches in the Verizon Data Breach Investigations Report (DBIR) and publishes this database online at VCDB.org. + The Vocabulary for Event Recording and Incident Sharing (VERIS) is a set of metrics designed to provide a common language for describing security incidents in a structured and repeatable manner. VERIS is a response to one of the most critical and persistent challenges in the security industry - a lack of quality information. In addition to providing a structured format, VERIS also collects data from the community to report on breaches in the Verizon Data Breach Investigations Report (DBIR) and publishes this database online at VCDB.org. @@ -687,7 +687,7 @@ Frameworks, platforms and services for collecting, analyzing, creating and shari XFE - X-Force Exchange - The X-Force Exhange (XFE) by IBM XFE is a free SaaS product that you can use to search for threat intelligence information, collect your findings, and share your insights with other members of the XFE community. + The X-Force Exchange (XFE) by IBM XFE is a free SaaS product that you can use to search for threat intelligence information, collect your findings, and share your insights with other members of the XFE community. @@ -929,7 +929,7 @@ All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly nyx - The goal of this project is to facilitate distribution of Threat Intelligence artifacts to defensive systems and to enhance the value derrived from both open source and commercial tools. + The goal of this project is to facilitate distribution of Threat Intelligence artifacts to defensive systems and to enhance the value derived from both open source and commercial tools. @@ -953,7 +953,7 @@ All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly poortego - Open-source ruby project to handle the storage and linking of open-source intelligence (ala Maltego, but free as in beer and not tied to a specific / proprietary datbase). + Open-source ruby project to handle the storage and linking of open-source intelligence (ala Maltego, but free as in beer and not tied to a specific / proprietary database). @@ -994,7 +994,7 @@ All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly RITA - Real Intelligence Threat Analytics (RITA) is inteded to help in the search for indicators of compromise in enterprise networks of varying size. + Real Intelligence Threat Analytics (RITA) is intended to help in the search for indicators of compromise in enterprise networks of varying size. @@ -1010,7 +1010,7 @@ All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly TAXII Test Server - Allows you to test your TAXII environment by connecting to the provided services and performing the different functions as writtten in the TAXII specifications. + Allows you to test your TAXII environment by connecting to the provided services and performing the different functions as written in the TAXII specifications. @@ -1171,7 +1171,7 @@ All kinds of reading material about Threat Intelligence. Includes (scientific) r Definitive Guide to Cyber Threat Intelligence - Describes the elements of cyber threat intelligence and discusses how it is collected, analyzed, and used by a variety of human and technology consumers.Fruther examines how intelligence can improve cybersecurity at tactical, operational, and strategic levels, and how it can help you stop attacks sooner, improve your defenses, and talk more productively about cybersecurity issues with executive management in typical for Dummies style. + Describes the elements of cyber threat intelligence and discusses how it is collected, analyzed, and used by a variety of human and technology consumers. Further examines how intelligence can improve cybersecurity at tactical, operational, and strategic levels, and how it can help you stop attacks sooner, improve your defenses, and talk more productively about cybersecurity issues with executive management in typical for Dummies style. @@ -1189,7 +1189,7 @@ All kinds of reading material about Threat Intelligence. Includes (scientific) r The Diamond Model of Intrusion Analysis - This paper presents the Diamond Model, a cognitive framework and analytic instrument to support and improve intrusion analysis. Supporint increased measurability, testability and repeatability + This paper presents the Diamond Model, a cognitive framework and analytic instrument to support and improve intrusion analysis. Supporting increased measurability, testability and repeatability in intrusion analysis in order to attain higher effectivity, efficiency and accuracy in defeating adversaries is one of its main contributions. @@ -1214,7 +1214,7 @@ All kinds of reading material about Threat Intelligence. Includes (scientific) r Intelligence Preparation of the Battlefield/Battlespace - This publication discusses intelligence preparation of the battlespace (IPB) as a critical component of the military decisionmaking and planning process and how IPB supports decisionmaking, as well as integrating processes and continuing activities. + This publication discusses intelligence preparation of the battlespace (IPB) as a critical component of the military decision making and planning process and how IPB supports decision making, as well as integrating processes and continuing activities. @@ -1279,7 +1279,7 @@ All kinds of reading material about Threat Intelligence. Includes (scientific) r Threat Intelligence: Collecting, Analysing, Evaluating - This report by MWR InfoSecurity clearly describes several diffent types of threat intelligence, including strategic, tactical and operational variations. It also discusses the processes of requirements elicitation, collection, analysis, production and evaluation of threat intelligence. Also included are some quick wins and a maturity model for each of the types of threat intelligence defined by MWR InfoSecurity. + This report by MWR InfoSecurity clearly describes several different types of threat intelligence, including strategic, tactical and operational variations. It also discusses the processes of requirements elicitation, collection, analysis, production and evaluation of threat intelligence. Also included are some quick wins and a maturity model for each of the types of threat intelligence defined by MWR InfoSecurity.