Integration of Cyber Threat Intelligence Data with SIEM Solution

Cyber threats are becoming increasingly complex, which motivated me to delve into developing a comprehensive solution for their detection and management. In this regard, the student independently recognised that the Open Cyber Threat Intelligence (OpenCTI) platform could play a key role in aggregating, enriching and sharing threat intelligence to improve their organisation's security.

Problem

Cyber threats are becoming increasingly complex, which motivated me to delve into developing a comprehensive solution for their detection and management. In this regard, the student independently recognised that the Open Cyber Threat Intelligence (OpenCTI) platform could play a key role in aggregating, enriching and sharing threat intelligence to improve their organisation's security. The challenge undertaken was quite demanding, as it involved integrating OpenCTI with a Security Information and Event Management (SIEM) system, which could hinder the seamless exchange of intelligence data.

Within the framework of the diploma thesis, the student therefore decided to delve deeper into this issue and conduct research and development of a connector for OpenCTI based on the Python programming language. The objective was to improve the exchange of threat intelligence and increase its utilisation within their existing security infrastructure. Through this process, the student decided to follow a systematic approach that included the following key steps: Requirements analysis; in collaboration with cybersecurity experts and SIEM administrators, the needs and expectations for OpenCTI-SIEM integration were defined, Design and architecture;

Solution and Method

Based on the defined requirements, a well-structured architecture for the Python-based connector was designed, Implementation; the connector was carefully coded in Python, utilising the power of relevant libraries and adhering to best practices in software development, Testing and validation; rigorous testing methodologies were employed to verify the accuracy, performance and compliance of the connector with the defined requirements, Documentation and user manual; to facilitate future deployment and use of the connector in their company, a comprehensive user manual was produced.

Within the framework of the diploma thesis, a custom OpenCTI connector based on Python was successfully developed for seamless data exchange between OpenCTI and their organisation's SIEM system. This integration enables the use of enriched threat data for better real-time detection, proactive cybersecurity measures and increased organisational resilience against threats. Furthermore, the implementation of this connector has also enabled the automation of cyber incident notification and response processes, improving defence efficiency and the protection of sensitive information and infrastructure.