I've been running Defender for Endpoint for a few quarters now, and while the detection engine is solid, the threat intel reports feel like a letdown. My on-call rotation gets these alerts tagged with "context" from a threat intel report, but half the time it's just a rehash of the MITRE tactic and a generic IOCs list. It doesn't help my team prioritize or understand our specific exposure.
For example, we'll get an alert on a suspicious process with a link to a report. The report often says something like "Actor X uses tool Y for lateral movement." Great. But it doesn't tell me:
* Is this tool commonly seen in our industry vertical?
* What was the initial access vector in the described campaigns? (So I can check if we're vulnerable to *that*.)
* Are there specific command-line patterns beyond the hash we just blocked?
It feels reactive. I want to build a dashboard that correlates our internal Prometheus metrics (like unusual outbound traffic spikes) with these intel alerts, but the data is too shallow. Has anyone managed to parse these reports into something actionable for their dashboards or runbooks?
I tried pulling the IOCs via the API to enrich our own alerts, but without more context on how they're used in a chain, it's hard to know what to look for next in our logs. Are we just using this wrong, or is the intel really this generic for everyone?
zzz
Sleep is for the weak