This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Evaluating Threat Intelligence Platforms
When to Use
Use this skill when:
Conducting a formal RFP or vendor evaluation for a TIP solution
Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales
Establishing evaluation criteria aligned to organizational maturity and budget
Do not use this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities.
Prerequisites
Documented CTI program requirements: team size, feed sources, integration targets, use cases
Budget range and procurement timeline
Technical staff who will administer the platform (Python/API experience for open-source TIPs)
List of current and planned integrations (SIEM, SOAR, EDR, firewalls)
Workflow
Step 1: Define Evaluation Criteria
Structure requirements into mandatory (M) and desired (D) categories:
Core TIP Functions:
M: STIX 2.1 import/export with TAXII 2.1 server
M: REST API for automated IOC ingestion and export
M: Indicator deduplication and TTL management
M: TLP classification enforcement
D: Built-in MITRE ATT&CK integration and technique tagging
D: Graph visualization of indicator relationships
D: Workflow automation for analyst triage
Integrations:
M: SIEM integration (Splunk, Sentinel, QRadar) via syslog, API, or native connector
M: EDR integration for IOC push (CrowdStrike, Defender, SentinelOne)
D: SOAR integration (XSOAR, Splunk SOAR) for playbook triggers
D: Ticketing system (ServiceNow, Jira) for intelligence task tracking
Operational:
M: Role-based access control with TLP-aware data segregation
Week 1–2: Infrastructure deployment (cloud or on-prem)
Week 3–4: Feed onboarding and deduplication tuning
Week 5–6: SIEM/SOAR integration and testing
Week 7–8: Analyst workflow configuration and training
Week 9–12: Operational validation and go-live
Key Concepts
Term
Definition
TIP
Threat Intelligence Platform — software for collecting, processing, analyzing, and disseminating cyber threat intelligence
TAXII Server
Component of a TIP that serves STIX bundles to consuming systems on request
TC Exchange
ThreatConnect's commercial marketplace for pre-built feed integrations and app connectors
Multi-tenancy
TIP capability to serve multiple organizational units or customers with isolated data environments
Deduplication
Process of identifying and merging duplicate indicators within a TIP to reduce analyst noise
Tools & Systems
MISP: Open-source TIP used by 6,000+ organizations; strongest ISAC/government community integration
OpenCTI: Modern open-source TIP with native STIX 2.1 and graph-based analysis
ThreatConnect: Enterprise commercial TIP with lifecycle management and SOAR playbook integration
Anomali ThreatStream: Commercial TIP with strong Splunk ecosystem integration
EclecticIQ: Commercial TIP with ATT&CK-centric workflow design
Common Pitfalls
Selecting TIP before defining requirements: Technology selection before use case definition leads to expensive mismatches.
Underestimating administration burden: MISP and OpenCTI require dedicated admin time (minimum 0.25 FTE); budget accordingly.
Ignoring data migration costs: Moving historical intelligence from one TIP to another is costly and often impractical for legacy systems.
Not testing SIEM integration in PoC: TIP value depends heavily on downstream integration quality; always test SIEM/SOAR connectivity during evaluation.
