Threat intel alerts reference

This section provides information about the available threat intel alerts.

Threat intel alerts provide warning of potential threats based on the latest intelligence and threat analysis. Each alert provides supporting facts that can be useful to you when investigating or implementing remediation steps.

For each documented alert, the following information is provided:

• A summary of the alert.
• Why the alert is important.
• Information about investigating the event that triggered the alert.
• Information about how to resolve the alert.

Advantages of Threat Intel alerts

The following are key advantages of Lacework FortiCNAPP's threat intel alerts, contributing to our prevention and detection cybersecurity strategies:

• Dynamic Severity Calculation - Our system determines severity based on the number of threat intel providers marking the Indicators of Compromise (IOC) as malicious, resulting in more precise threat assessment and prioritization. This reduces false positives and enhances accuracy for customers.
• Leveraging Customer Databases - We utilize Lacework FortiCNAPP Customer Databases (CDBs) containing attacking external IP addresses to power indicator-based detection approach. This enables more accurate measurement of severity.
  • Targeted Customer Mapping: Severity levels dynamically consider the number of targeted customers for an indicator, providing an accurate representation of potential threats and estimated impact across Lacework FortiCNAPP's customer base.
  • Daily IOC Database Updates: Our IOC database is now updated daily, ensuring up-to-date and fresh data.
  • Automated Time-To-Live (TTL) Evaluation: A daily automated process evaluates the time to live (TTL) of an IOC, ensuring the database remains current and relevant. We have a 90-day maximum retention period by default.
• Enhanced Tag System - We have revamped the tag system to provide more contextual information in the Console.
  • Malicious Intel Provider Hit Count: Tags now include the hit count of malicious intel providers, offering additional insight.
  • Additional Filtration Layer: A new filtration layer excludes specific Autonomous System Number (ASN) owners and networks from VirusTotal. Contact Fortinet Support for the list of excluded ASN owners.

These advancements strengthen Lacework FortiCNAPP's threat intel alerts, empowering organizations with greater visibility and actionable intelligence for comprehensive cybersecurity.

Inbound IOC alerts are assigned a severity one level lower compared to outbound alerts. For example, if an IOC is identified as malicious by 10 or more providers, it will be classified as Medium severity for inbound connections and High severity for outbound connections. For more information, refer to Alert Severity.