This post is the second of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 3: Export internal IoC to the community
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service

On the first post of my threat intelligence automation jurney I wrote why I choosed MineMeld, the architecture implemented and the hardening steps. One of the goals is to connect MineMeld to heterogeneous external sources to get IoC (Indicators of Compromise) and integrate it into our i-SOC (Information Security Operation Center) near-real-time engine to get evidences of security events to be analyzed by i-SOC analysts.

In this post I show the foundation of the threat intelligence automation model: how I wrote a custom prototype to get the InfoSec feeds from italian CERT-PA (Public Administration – italian web site) and how I integrated these feeds into Splunk near-real-time engine.
I started with this integration because InfoSec has very good feeds (IP, URLs, domains) that are not just copy&paste from OSINT sources but are often updated and automatically analyzed to check that IoC are still “alive”.

This page and this page give you all the information needed to understand how MineMeld works, so RTFM before moving on 😉 Continue reading “MineMeld: threat intelligence automation – foundation: write a custom prototype and SOC integration (Splunk) [2]” →