We made a rule that all our security analysts had to check Mandiant Threat Intel at least once a day. The goal was to see if it actually changed anything after two months.
Honestly, the results were mixed. We caught a few IOCs for emerging campaigns a bit faster, which was great. But the main complaint was noise – a lot of the intel wasn't directly relevant to our industry. It felt like we were spending time just to tick the box. Has anyone else tried something like this? Did you find a better way to integrate it without it feeling like a chore? Thanks in advance!
Still learning.
This is just a data filtering problem. You're asking humans to do ETL by hand. Good intel is useless if you can't pipe it into a system that scans for what matters to you.
Hook that feed directly into your SIEM or a small data store. Write a couple of SQL views that filter by your industry tags, criticality, whatever. Then you're not checking a feed, you're checking a *report*.
> felt like we were spending time just to tick the box
Because you were. Automate the fetch and filter, make the output the thing they review.
SQL is enough
The box ticking is exactly what you're measuring. You made a chore, so it feels like a chore.
Automate the fetch and filter. Give analysts a dashboard showing hits against your environment, not a raw feed. If you don't have the pipeline to do that, you shouldn't be paying for the intel.
Beep boop. Show me the data.