Threat Intel Management use cases

Explore Threat Intel Management use cases in Cortex AgentiX.

The following examples illustrate typical use cases for Threat Intel Management analysts.

Dynamic allow lists for business-critical SaaS apps

In this example, Firewall Admins are responsible for ensuring employees can always access SaaS applications such as Zoom and Office 365. They need to manage a stream of inbound change requests from the security team and other business units. Regardless of these daily changes, critical apps must always be allowed. The network infrastructure of SaaS applications is constantly changing/rotating IP addresses and Domains.

1. Configure a feed integration such as Office 365, Amazon AWS, or Unit 42.

   1. Navigate to Settings → Data Sources & Integrations.
   2. Search for and select the relevant integration and click Add Instance.

      In this example, add the AWS feed.
   3. Set up the instance. In the Indicator Reputation field, select Benign.
   4. Test and save the instance.
2. (Optional) Configure a playbook to filter indicators according to your requirements.
3. Go to the Indicators page and run the following search to return IP, IPv6 or IPv6CIDR results:

   sourceBrands:"AWS Feed" and expirationStatus:active and type:IP or type:IPv6 or type:IPv6CIDR
4. Configure the Generic Export Indicator Service integration.

   1. On the Data Sources & Integrations page, search for and select Generic Export Indicators Service, and click Add Instance.
   2. In the Indicator Query field, add the query in step 3.
   3. Add the remaining fields, test, and save.
5. Test the EDL by running the cURL command: curl -v-u- user:pass https://ext-<tenant>crtx<region>.paloaltonetworks.com/xsoar/instance/execute/<instance-name>

Proactive blocking of known threats

The security team needs to leverage threat intelligence to block or alert on known bad domains, IPs, hashes, etc. (indicators). The indicators are collected from many sources, which need to be normalized, scored, and analyzed before pushing to security devices such as firewalls for alerting. Detection tools can only handle limited amounts of threat intelligence data and need to constantly re-prioritize indicators.

Solution

Indicator prioritization. Cortex AgentiX can ingest phishing issues from email inboxes through integrations. Once an issue is ingested, a playbook is triggered and can have any combination of automated or manual actions that users desire. The playbooks can have filters and conditions that execute different branches depending on certain values.

1. Configure feed integrations such as Unit 42 Feed, TAXII feed, etc.

   1. Navigate to Settings → Data Sources & Integrations.
   2. Search for and select the relevant threat intel feed integration and select Add Instance.
   3. Set up the instance.

      Leave the Indicator Reputation field blank.
   4. Test and save the instance,
2. (Optional) Configure a playbook to filter indicators according to your requirements.
3. Go to the AGENTIX Indicators page and run the following search to return IP addresses with the verdict malicious with high reliability:

   expirationStatus:active and type:IP and verdict:malicious and aggregatedReliablitiy:A - Completely reliable
4. Configure the Generic Export Indicator Service integration.

   1. Navigate to Settings → Data Sources & Integrations.
   2. Search for and select Generic Export Indicators Service and click Add Instance.
   3. In the Indicator Query field, add the query in step 3.
   4. Add the remaining fields, test, and save.
5. Test the EDL by running the cURL command: curl -v-u- user:pass https://ext-<tenant>crtx<region>.paloaltonetworks.com/xsoar/instance/execute/<instance-name>

   You can use this URL in your Next-Generation Firewall.