Intelligence is an on-going process. You set it up – collection, processing, dissemination – based on certain work assumptions and then you continuously improve it using the results that you receive. Only through reviewing results can you expose commonalities across false positives, identify search queries that are too generic, or find any other issue. With this information, data collection and processing can be improved, for example, by filtering out any keywords that indicate a finding is irrelevant.
The mission behind IntelFinder is a straightforward one – make threat intelligence accessible to as many organizations as possible. In order to achieve that, we have developed technology that enables us to fully automate the intelligence generation process – from collection to dissemination. This is how we can offer the service at a fraction of the cost compared to existing service on the market, making threat intelligence relevant for the first time to many smaller security teams and organizations. Up until now, the focus of our automation was in retrieving the intelligence, analyzing it with the purpose of generating a clear well-written intelligence alert.
Today, we are proud to announce the next step forward in automating the threat intelligence process – the Virtual Analyst.
Virtual Analyst is an artificial intelligence which analyzes intelligence alerts of each user in order to identify commonalities, trends and issues. Based on the analysis, it provides the user with suggestions on how to improve the intelligence operation – by changing a setting, adding a keyword to a whitelist, or changing a company asset. The goal of these suggestions is to reduce the number of false positives, ensure that true positives are reported on, and improve the efficiency of the intelligence operation.
The algorithms used for each analysis are “handmade”. We have codified over 15 years of experience in intelligence analysis, to ensure the suggestions are relevant, impactful and are made only when necessary. IntelFinder’s alert triage system, through which users define whether alerts are true or false positives, is taken into account during analysis (and in fact a necessity for many analyses), to ensure every suggestion is tailor-made for each user’s unique case.
Virtual Analyst further drives our goal of making threat intelligence accessible, providing suggestions and guidance to users, whatever their experience is in threat intelligence and cyber security, on how to maximize the value from IntelFinder. It is an integral part of IntelFinder and a great example for where we strive to take our service in the future.