📢 𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐭𝐡𝐞 𝐓𝐈𝐅𝐂𝐄 𝐖𝐨𝐫𝐤𝐛𝐨𝐨𝐤 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥! Everyone who knows me knows how passionate I am about the 𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 (𝐂𝐓𝐈) discipline. Back in early 2020, just before the pandemic outbreak, I had the opportunity to travel to Luxembourg for hands-on training on the @MISPProject and later on, attend two @FIRSTdotOrg CTI events in Berlin. Since then, I’ve been fortunate to work on many CTI initiatives, especially during my tenure at Alpha Bank, where my team pioneered in this area within the FSI sector. Over the years, the CTI discipline has significantly matured. With that evolution came frameworks, operational requirements, and the growing challenge of managing multiple intelligence feeds - many of which may not be relevant, actionable, or current enough to effectively protect an organization. Inspired by the TIFCE framework introduced by Sergio Albea, I built the 𝐓𝐈𝐅𝐂𝐄 𝐖𝐨𝐫𝐤𝐛𝐨𝐨𝐤 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥. 🔗 github.com/cyb3rmik3/KQL-thr… The workbook evaluates the four key pillars of the TIFCE framework: ✅ Which feeds provide unique intelligence? ✅ Which feeds are truly relevant to your environment? ✅ Which feeds correlate with confirmed malicious activity? ✅ Which feeds are fresh and actively maintained? If you are using 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥 and the 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐗𝐃𝐑 stack together with multiple 𝐓𝐡𝐫𝐞𝐚𝐭 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 feeds (MDTI, MISP etc), I encourage you to test the workbook and review the findings. Feedback and contributions are always welcome - feel free to open an Issue or submit a PR with enhancements and ideas. I know already that more visuals and some tabs with more info are needed. A huge thank you to my comrade Marios for his contributions, and to MVP brothers Sergio Albea, @BertJanCyber, and Uros Babic for their valuable preview feedback. #MicrosoftSecurity #MicrosoftSentinel #UnifiedSecOps #ThreatIntelligence #CyberThreatIntelligence #KQL #KustoQueryLanguage

Next Tuesday, May 27th Christos Galanopoulos and I will join my dear fellows @alexverboon and @castello_johnny at this month's 𝐊𝐐𝐋 𝐂𝐚𝐟𝐞. Christos Galanopoulos and I worked over the past couple of months on 𝐬𝐊𝐚𝐥𝐞𝐐𝐋, a tool that allows query automation on your log analytics workspace, through GitHub actions. We are going to elaborate how this tool works and provide a couple of examples of how one can benefit from this tool. 📅 Have you registered for next week's 𝐊𝐐𝐋 𝐂𝐚𝐟𝐞? No? Please do so here: meetup.com/kql-cafe/events/3… ⚙️ Have you checked 𝐬𝐊𝐚𝐥𝐞𝐐𝐋? If not, check it out here: github.com/christosgalano/sK… #MicrosoftSecurity #MicrosoftCommunity #KQL #KustoQuery #KQLCafe #sKaleQL #GitHub #GitHubActions