Creating Real Threat Intelligence with Evernote & Open-Source Feeds
Security analyst Grecs shows how to build an agile, cost-effective threat intelligence repository using Evernote and curated open-source indicators.
Summary
The Pitfalls of Expensive Commercial Threat Feeds
Many organizations invest heavily in proprietary threat feeds that deliver raw IP lists without contextual relevance to their specific threat environment.
Structuring a Pragmatic Threat Intelligence Knowledgebase
Grecs demonstrates using Evernote's tagging, indexing, and optical character recognition (OCR) to catalog adversary tactics, techniques, and procedures (TTPs).
Harvesting and Curating Open-Source Intelligence
The speaker reviews scraping security blogs, malware analysis reports, and CERT advisories into structured threat actor dossiers.
Operationalizing Threat Intel for SOC Analysts
The presentation illustrates rapid search and cross-referencing workflows to accelerate alert validation and incident response investigations.
Related talks
Recon Village·21 min
Manabu Niseki
Manabu Niseki presents Mihari, an open-source framework that queries multiple threat intelligence search engines to continuously track adversary C2 infrastructure.
Red Team Village·46 min
Apurv Gautam
Apurv Gautam demonstrates building automated crawlers and threat intelligence collectors to monitor Tor darknet markets and paste sites for leaked corporate data.
Village Presentations·53 min
Tim Newberry
Tim Newberry analyzes social media radicalization and terrorist network propagation on Twitter, mapping bot swarms and extremist recruitment vectors.