Hot answers tagged

4

Advanced Persistent Threats (APT) describes actual threats. Depending on who you talk to and the context these are sophisticated and targeted attacks by advanced actors with lots of money like states or criminal organisations - or simply anything which is more complex than what basic firewalls and antivirus products could detect (like in "it wasn't our ...


3

Based on the setup described in the question and comments this kind of traffic is likely innocent. You seem to run a DNS server which recursively resolves the domains. In order to resolve a domain it would need to query multiple DNS servers, starting with the root servers. The DNS servers which are queried might be all around the world, depending on the ...


3

... serving accurate information ... I doubt that these information are accurate. There is some truth in it based on what vendors see from honeypots, from installations at customers and from public available data but the vendors don't really see or know everything. The main point of such threat maps is to make it clear that there is sufficient danger on ...


2

First thing first, the very link you cite says "hoax" right in the URL. Wiktionary defines the noun hoax thus: Anything deliberately intended to deceive or trick. That should be a pretty big clue right there that this isn't true. According to Wikipedia, WhatsApp uses a centralized server architecture where messages are passed through and temporarily ...


1

My question is how I can build one, what are the parts of a TIG in terms of hardware, Welcome to the world of "market speak" where vendors try to make improvements sound like something entirely new. Threat intelligence isn't about hardware, it's more of a service. It is about "threat intelligence" and the ability to deliver this intelligence quickly and ...


1

You are trying to combine a couple of different types of risk that you need to keep separate: inherent risk (risk without treatment/mitigations/controls) residual risk (risk after treatment/mitigations/controls) You are also defining your threats far too specifically to the vulnerability, which is causing you further chicken/egg confusion. You state that ...


1

Threat hunting is the human-driven, proactive and iterative search through networks, endpoints, or datasets to detect malicious, suspicious, or risky activities that have evaded detection by existing automated tools. You can use a variety of tools and techniques to look for that !it's not related to a certain tool/technology! you just conduct investigations ...


Only top voted, non community-wiki answers of a minimum length are eligible