Cyber Security
Cyber Threat Intelligence (CTI) Management
We monitor threat intelligence sources, extract the indicators (IOCs) that matter to you, feed them into your security systems and send you prioritized alerts and reports.
What is cyber threat intelligence?
Cyber threat intelligence (CTI) means collecting and validating information about attackers, their infrastructure and their methods, and turning it into decisions for your organization. Raw data alone is not intelligence. Information becomes intelligence when it is linked to your assets, your sector and the technologies you use.
CTI helps the security team answer these questions: Which threats can target us? Which indicators should we block? Which vulnerabilities should we close first? Is an observed event part of a known attack campaign?
Sources we monitor
Open-source threat feeds
Open sources that publish malicious IP addresses, domains, URLs and file hashes.
National and sector notices
Notices from national computer emergency response teams (CERT/CSIRT) and sector sharing communities.
Vendor security advisories
Vulnerability advisories for the operating systems, network devices and applications you use.
Our own observations
Indicators from events we observe in our SIEM-SOC Management service.
SIEM-SOC ManagementOrganization-specific monitoring
New registrations that look like your domain and open-source findings about your company name.
Indicators of compromise (IOCs) and their lifecycle
An indicator of compromise (IOC) is technical data that carries a trace of an attack: an IP address, domain, URL, file hash or email sender. We also classify indicators by attack techniques (TTPs) and the MITRE ATT&CK framework.
1. Collection
We receive indicators from the sources automatically.
2. Validation
We remove indicators that can cause false positives, such as shared hosting IP addresses and well-known service domains.
3. Scoring
We prioritize each indicator by reliability and relevance to you.
4. Distribution
We feed the indicators into your systems such as SIEM, firewall, email gateway and endpoint protection.
5. Expiry
We remove aged indicators from the lists to avoid needless blocking.
Alert flow
An alert is raised when an indicator appears in your environment or when a threat directly relevant to you is reported. Our analysts assess the alert first. If there is a real risk, we send you the alert with a priority class and a recommended action.
1. Detection
An indicator match or a notice relevant to your organization arrives.
2. Assessment
An analyst checks whether the match is real and what its impact is.
3. Notification
We send the confirmed alert to your contact person through the agreed channel.
4. Response
We apply blocking, patching or investigation steps together with you.
5. Closure
We record the event and add the lessons learned to the rules.
Reporting
Real-time alerts
For confirmed, high-priority threats.
Regular summary report
Blocked indicators, matches, new vulnerabilities and campaigns relevant to you.
Management report
Threat trends, risk assessment and recommended improvements.
The service contract defines the scope and frequency of the reports.
Link to SIEM-SOC and other security services
Cyber threat intelligence does not work alone. The indicators become rules and correlations in our SIEM-SOC Management service. We apply addresses that need blocking within Firewall Management. We verify high-profile vulnerabilities in your environment with Penetration Testing. We feed malicious email indicators into email security systems such as Proxmox Mail Gateway.
Service process
1. Requirements
We define your priority intelligence questions and your critical assets.
2. Inventory
We list your domains, public IP addresses and the technologies you use.
3. Integration
We connect the indicator feed to your security systems.
4. Tuning
In the first period we tune thresholds and rules to reduce false positives.
5. Operation
We monitor sources, assess alerts and send reports regularly.
For the cyber threat intelligence service, write to us through the contact form.
Frequently asked questions
What is the difference between threat intelligence and SIEM?
A SIEM collects logs from your systems and detects events. Threat intelligence collects threat information from outside and tells the SIEM what to look for. The two services work together: intelligence indicators go into SIEM rules, and SIEM findings flow back into intelligence.
Which sources do you use?
We use open-source threat feeds, national and sector CERT notices, vendor security advisories and our own SOC observations. For your organization we also monitor registrations that look like your domain and open-source findings.
What is an IOC and how is it used?
An IOC is technical data that carries a trace of an attack: an IP address, domain, URL, file hash or email sender. We validate and prioritize the indicators and feed them into your firewall, SIEM and email security systems. We remove aged indicators from the lists.
How do you send alerts to us?
Our analysts assess the alerts first. We send a confirmed alert with its priority class and a recommended action to your contact person through the agreed channel. The contract defines the priority classes and communication rules.
How often do we receive reports?
We send real-time alerts for confirmed high-priority threats. In addition, we prepare a regular summary report and a management report. We define the report frequency and scope together in the service contract.
Does it work with our current SIEM or firewall?
Yes. We feed the indicators into common SIEM and firewall products in standard formats. Before integration we review your current systems and choose the method together.
Related services
SIEM – SOC Management
We collect your system logs in a SIEM platform, monitor security events with our SOC team and pass verified incidents on to you.
Firewall Management
We install your firewall, write its rule set and run it day to day. We work with FortiGate, Palo Alto Networks and MikroTik devices.
Penetration Testing
We run controlled attack tests against your systems, identify vulnerabilities and report the findings with remediation advice.
Proxmox Mail Gateway Deployment and Support
Filter spam, viruses and phishing emails with Proxmox Mail Gateway before they reach your mail server; get deployment, licensing and support from Synchron.
Let's discuss your project
Tell us what you need and we will match you with the right team. For urgent issues, call our support line.