热门威胁情报库深入分析（三）

第三部分：AlienVault-OTX

3.1 数据来源

1. AlienVault Labs threat research team：

This dedicated team spends countless hoursanalyzing the different types of attacks, emerging threats, suspiciousbehavior, vulnerabilities and exploits they uncover across the entire threatlandscape.

AlienVault Labs Threat Intelligence drivesthe USM platform’s threat assessment capabilities by identifying the latestthreats, resulting in the broadest view of threat vectors, attacker techniques andeffective defenses. AlienVault Labs regularly delivers eight coordinated ruleset updates to the USM platform. 

2. 通过超过37000来自OTX社区的参与者，收集威胁数据

3.2 功能服务

包含的搜索信息有：

1. IP地址

2. 文件校验：MD5，SHA1，SHA256，pehash，imphashdomain， Hostnames (subdomains)， Email， URL， URI， CIDRrules， File paths，MUTEX name，CVEnumbers

3. 有公开的API接口可以使用

https://github.com/AlienVault-Labs/OTX-Python-SDK

4. 专门提供给公司的高级管理系统USM：Logs carry importantinformation such as what your users are doing, what data they are accessing,the performance of your systems and overall network health. They will alsocontain evidence of system compromise and data exfiltration, if you know whereto look.

USM automatically detects and linksbehavior patterns found in disparate yet related events generated acrossdifferent types of assets, telling you what are the most significant threatsfacing your network right now.

USM：日志包含重要的信息：使用者在做什么，他们在获取什么数据，你的系统运行如何以及整个网络的健康状态。日志同样包括系统入侵和数据泄露的证据。

USM自动探测和联系被发现的在不同资产上的独立行为的行为模式，得到你的网络面临的最重要的威胁信息。

Network IDS signatures – detect the latest malicious traffic on your network

Host IDS signatures – identify the latest threats targeting your critic