Pivoting in MISP: From Individual Indicators to Broader Threat Context 

In the first post, we set up VMRay UniqueSignal as a feed in MISP. In the second post, we looked at how a SOC or CSIRT can use that feed for detection, hunting and blocking. This third post looks at the feed from a different angle: the CTI analyst. How do you pivot, enrich the data, and build a broaderVMRayRead More