Collection Priorities

[sroberts]

It's always hard to figure out where to start a threat intelligence program. Here's some thoughts on collection:

• Internal Incident Data
• Honeypots & The Like (Emphasis on The Like)
• Vendor Reports
• Sharing Communities
• Free IOC Feeds
• Paid IOC Feeds

[sroberts]

I may consider adding something on "Strategic" or "Long form" intelligence. I go back and forth on where to put it. It could be at the beginning or the end.

[krmaxwell]

In my mind, this should lead in by relating your collection priorities to your intel requirements.

[sroberts]

@krmaxwell Yeah that's my thought process.

[sroberts]

• [x] Make sure to add link to requirements post.
• [x] Make sure to update date for user name.