Intelligence Browser

the intelligence browser is the primary research surface of the cti module it lets you inspect threat intelligence directly in flare, including iocs such as malicious ips, urls, and file hashes, along with threat actor profiles, campaigns, intrusion sets, and ttps rather than pivoting between separate tools, you research threats from a single destination that draws on multiple intelligence providers when you encounter an indicator, you can immediately understand who is behind it, whether the actor is credible, what campaign it is connected to, which ttps are in play, and what other indicators to look for intelligence is sourced from two providers simultaneously flare's catalog built from flare's collection of dark web forums and telegram channels external feeds from a global cti provider with extensive coverage across adversary groups, malware families, and active campaigns a single search returns results from both sources in a unified view access to this feature requires an add on please reach out to your csm for more information key features multi provider entity exploration browse threat actors, campaigns, intrusion sets, malware families, and iocs from both flare's intelligence catalogue and external feeds in a single unified view you do not need to run separate queries per provider actor profiling when you open an actor profile, you get a credibility assessment behavioral patterns and known activity ttps mapped to mitre att\&ck entity relationships showing how this actor connects to campaigns, infrastructure, and known iocs credibility assessment is important because not all dark web activity is genuine the intelligence browser helps you distinguish signal from noise before you act on it ioc threat context indicators in the intelligence browser are not standalone data points each ioc is linked to the actor, campaign, or malware family that produced it you can see whether it is currently active, what campaign it belongs to, and who is operating it forum and channel intelligence the intelligence browser includes deep analysis of dark web forum thread activity this includes thread context, entity relationships, and links to emerging threats observed in those communities it connects observed activity to known actors and indicators rather than returning surface level keyword matches how to use the intelligence browser click through the following product tour to learn how to use the intelligence browser search the catalogue enter an ioc (domain, ip, url, file hash), a threat actor name, a campaign name, or a ttp in the search bar the search runs against both flare and partner intelligence simultaneously drill into an entity from your search results, open the entity profile that is most relevant to see detailed information for a threat actor, for example, this shows credibility, behavioral history, and ttps mapped to mitre att\&ck for a campaign, it shows the associated actors, malware, and timeline for a malware family, you can see its metadata, its place on the cyber kill chain, its techniques mapped to mitre att\&ck, and a written analysis of how it operates explore relationships each entity is connected to related entities for a threat actor, for example, you can navigate to the campaigns they have run, the infrastructure they use, the iocs they have generated, and the dark web forums where they operate for a malware family, you'll see the campaigns that deliver it, the infrastructure it relies on, the attack patterns it uses, and the indicators that detect it this gives you the full picture of a threat from a single starting point continue investigation in threat flow once you have completed your research, use threat flow to package your findings into a structured intelligence report threat flow uses the same intelligence catalog to generate reports, therefore, entities you research in the intelligence browser can become the subject of a threat flow report searching and filtering search across all intelligence objects and focus the results to what matters to your investigation search enter a term in the search bar, such as a threat actor name, a campaign, a domain, an ip, a url, or a file hash select the following options for quick filtering type select one or more types to limit results to a single intelligence object type, or leave it set to all types date select a date range to filter by when objects were created, updated, or seen filter select filters for more detailed filtering options sources view objects only from specific intelligence sources you can select to view intelligence from chats, communities, or both topics view objects associated with one or more topics, such as the tools and capabilities involved, the type of malicious activity, or the actor's motivation search within the list, select individual topics, or choose select all a count next to each topic shows how many matching objects are available, and each topic can be expanded for more specific subtopics confidence show only objects at or above a chosen confidence score see object confidence score for more on how this score works observable types when filtering to indicators, drill down to a specific ioc type, such as ip addresses, domains, or file hashes this lets you pull a targeted list, for example just ip addresses to update firewall rules, or just file hashes to update edr and email gateway policies this filtering is also available through the entities api https //api docs flare io/api reference/v4/endpoints/public/list entities object confidence score each intelligence object is assigned a confidence score that reflects how strongly the intelligence is supported by evidence you can use this score to gauge how much weight to give an object, for example to focus on high confidence indicators before applying them to detection or blocking the confidence score can be surfaced in two ways in the intelligence browser as a column add confidence to the results table to see each object's score alongside its type, name, and sources as a filter filter by confidence to narrow results to objects at or above a chosen score show the confidence score as a column 1\ in the intelligence browser, open the columns menu 2\ select confidence to add it to the results table filter by confidence score 1\ click filters to add filtering 2\ select the confidence filter 3\ choose the score you want to filter by results update to show only objects that match intelligence objects the intelligence browser contains the following entity types each has its own detail view with sources, metadata, and relationships you can filter by one entity type or stack multiple filters results aggregate in a single query across all sources entity type description actor individual surfaced from flare's data, and not yet mapped or attributed attack pattern techniques mapped to the cyber kill chain and mitre att\&ck tactics, with provider metadata and full descriptions of how adversaries operate campaign coordinated, time bounded threat activity that ties actors, malware, and ttps together under a single named operation chat channels messaging channels and groups tracked with their posts, participants, and the linked actors and indicators surfaced inside external reports collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details forum thread dark web forum posts with full thread context, including author, timestamps, and the linked actors and indicators discussed inside indicator atomic iocs such as domains, urls, ips, and file hashes, each tied back to the actor, malware, or campaign that produced them infrastructure the systems adversaries rely on, including command and control servers, hosting, asns, and supporting assets behind active operations location geographic references such as countries, regions, or cities, used to tie threat activity to where it originates or targets malware named malware families with their capabilities, samples, and the campaigns and actors known to operate them threat actor threat actor groups named individuals, groups, or organizations believed to be operating with malicious intent, with attributed campaigns, ttps, and tracked aliases tool legitimate software that can be used by threat actors to perform attacks vulnerability cves with exploitability context, including which actors are weaponizing them and which malware families leverage them in the wild