Read insights, thought leadership, and platform updates.
No Blogs Match Your Results
Please try again or contact marketing@threatconnect.com for more information on our blogs.
SOC Series: Follow the Swing
Today’s post continues an ongoing series on Polarity Security Operations Center (SOC) use cases; demonstrating how Polarity helps you to see the story in your data without sacrificing thoroughness or speed. Your analyst team lives a high stress and often painful life. They have to be right as close to 100% of the time as […]
SOC Series: Determining Asset Criticality During Event Triage
Today’s post continues an ongoing series on Polarity Security Operations Center (SOC) use cases; demonstrating how Polarity helps you to see the story in your data without sacrificing thoroughness or speed. Understanding asset criticality, function, and location are absolutely critical when triaging an event to determine whether or not it is an actual incident requiring […]
ThreatConnect and PagerDuty: Better Alert Management
ThreatConnect has released a Playbook App for joint customers to leverage PagerDuty. With this new Playbook App, you can easily monitor alarms and notify team members when necessary – leading to a more efficient and effective security team. PagerDuty is a real-time operations platform to manage alerts and escalations for system administrators and support teams. […]
SOC Series: Developing the Analyst Team
Today’s post continues an ongoing series on Polarity Security Operations Center (SOC) use cases; demonstrating how Polarity helps you to see the story in your data without sacrificing thoroughness or speed. SOC Leadership must balance speed of analysis with quality of analysis. Turnover of analysts also means knowledge and experience loss and a continual skill […]
ThreatConnect and Cisco Secure Access by Duo: Save time during IdAM Investigations
ThreatConnect has partnered with Cisco Security to deliver a Playbook App for joint customers to use Cisco Secure Access by Duo (formerly Cisco Duo). Now, users can automate processes during an internal security investigation when it’s critical to quickly get user information or suspend users involved with a security incident. The App allows you to: […]
Playbook Fridays: Have You Been Pwned?
Enriching Indicators with haveibeenpwned ThreatConnect developed the Playbooks capability to help analysts automate time consuming and repetitive tasks so they can focus on what is most important. And in many cases, to ensure the analysis process can occur consistently and in real time, without human intervention. Why Was the Playbook Created? Data breaches come and […]
ThreatConnect and VirusTotal: Enable YARA Hunting and Better Malware Analysis
ThreatConnect and VirusTotal have improved our collaboration with a new Playbook App! This app will allow you to send malware to a sandbox to be further examined and retrieve the results from VirusTotal. Leveraging this App, you will be able to perform Phishing Email Triage, Endpoint Investigation, and Malware Hunting. This all leads to more […]
ThreatConnect Research Roundup: Wizard Spider / UNC1878 / Ryuk Campaign
Howdy, and welcome to the ThreatConnect Research Roundup, a collection of recent findings by our Research Team and items from open source publications that have resulted in Observations of related indicators across ThreatConnect’s CAL™ (Collective Analytics Layer). In this Roundup, we highlight the Late 2020 Wizard Spider / UNC1878 / Ryuk Campaign. In late September […]
ThreatConnect and McAfee DXL: Better Integrations with the McAfee Stack
ThreatConnect has partnered with security giant McAfee and released multiple Playbook Apps and one App Service for McAfee DXL. McAfee DXL is a communication fabric and it allows us to easily connect with nearly every piece of McAfee technology. The Playbook Apps will allow you to Publish Events and Invoke Services on DXL topics while […]
Who’s Next: A look at CAL 2.6’s latest additions
We’re proud to announce the release of CAL 2.6, our latest addition to our Collective Analytic Layer’s featureset. As the latest in our ongoing quest to find the most interesting intelligence and deliver it to you, we’ve decided to incorporate some additional datasets in the form of WHOIS records, a partnership with Quad9, and even […]
ThreatConnect Research Roundup: Ryuk and Domains Spoofing ESET and Microsoft
Howdy, and welcome to the ThreatConnect Research Roundup, a collection of recent findings by our Research Team and items from open source publications that have resulted in Observations of related indicators across ThreatConnect’s CAL™ (Collective Analytics Layer). Note: Viewing the pages linked in this blog post requires a ThreatConnect account. Roundup Highlight: Ryuk In this […]
SOC Series: Share with Your Friends in IR
Today’s post continues an ongoing series on Polarity Security Operations Center (SOC) use cases; demonstrating how Polarity helps you to see the story in your data without sacrificing thoroughness or speed. Incident Responders are often relegated to working in an environment where communication channels are compromised or non-existent. Real time information of the environment is […]