Customized Indicator-of-Compromise (IOC) Feeds

Tailored Threat Intelligence to Match Your Threat Profile, Infrastructure & Industry

---

📄 1. Statement of Work (SOW)

Service Name: Customized Indicator-of-Compromise (IOC) Feeds
Client Type: SOC Teams, MSSPs, Large Enterprises, Critical Infrastructure, Defense
Service Model: Subscription-Based, API-Delivered, Industry-Aligned
Compliance Coverage: MITRE ATT&CK, ISO 27001, NIST CSF, SOC 2
IOC Types Supported:

• IP Addresses, Domains, URLs
• File Hashes (MD5, SHA1, SHA256)
• Email Addresses, Hostnames
• Registry Keys, File Paths
• MITRE TTPs, YARA/Sigma Rules

---

🧠 2. Our Approach (with Visual)

🔹 Sector-Specific IOC Tuning
🔹 Source Enrichment & Confidence Scoring
🔹 Real-Time, Format-Flexible Delivery

[Client Profile Mapping] → [Feed Source Aggregation] → [IOC Filtering & De-duplication] → [Contextual Enrichment] → [Feed Structuring & Scoring] → [Integration & Alerting] → [Ongoing Review & Optimization]

---

🧪 3. Methodology (with Visual)

[Client Profile Collection] → [Industry Threat Mapping] → [Feed Aggregation from Trusted Sources] → [IOC Confidence Scoring & Tagging] → [Delivery Format Selection] → [Feed Integration via API] → [Monitoring & Monthly Refinement]

---

📦 4. Deliverables to the Client

1. ✅ Customized IOC Feed API (JSON/STIX/CSV)
2. 🧾 Feed Configuration Sheet
3. 🧭 MITRE ATT&CK Mapping for Indicators
4. 📘 IOC Feed Pack including:
   • Indicator Type (IP, Hash, Domain, etc.)
   • Confidence Score
   • Threat Actor Association
   • Expiry Timeline
   • TTP Tag (if applicable)
   • Source Metadata
   • References
5. 📊 IOC Trend Visualization Dashboard
6. 📽️ Integration Support Call
7. 🧑‍💻 IOC Alert Use Case Guidance
8. 🔁 Monthly IOC Review & Enrichment Updates
9. 🎓 Feed Certification (Confidence & Format Compliance)

---

🤝 5. What We Need from You (Client Requirements)

• ✅ Target Platforms (SIEM/XDR/EDR)
• ✅ Ingestion Format (STIX, JSON, CSV, XML)
• ✅ Industry & Region Focus
• ✅ IOC Type Prioritization (IP, Hash, Domain, etc.)
• ✅ API Key/Token for Integration (if needed)
• ✅ POC for Alert Correlation & Tuning

---

🧰 6. Tools & Technology Stack

• 🔬 Threat Aggregators (OTX, MISP, ThreatFox, IntelX)
• 🧠 Custom IOC Scoring Engines
• 📡 STIX/TAXII Servers
• 📁 IOC Enrichment via WHOIS, DNSDB, VirusTotal
• ⚙️ JSON→YARA/Sigma Converters
• 📊 Elastic/Kibana Dashboards
• 🔗 MITRE ATT&CK Integration Toolkit

---

🚀 7. Engagement Lifecycle (Lead → Closure)

1. Discovery Call 2. Client Profile Capture 3. Feed Type & Format Finalization 4. Indicator Filtering and Enrichment 5. Feed API Setup 6. Platform Integration Support 7. IOC Usage Validation 8. Monthly Review Calls 9. Tuning and Threat Mapping Expansion

---

🌟 8. Why Sherlocked Security? (Our USP)

Feature	Sherlocked Advantage
🧠 Profile-Based Feeds	IOC relevance tied to client industry and region
📘 Confidence-Scored IOCs	Reduce false positives in alerting systems
📡 Format Agnostic Delivery	STIX, JSON, CSV, API or webhook ready
🧑‍💻 SOC-Centric Use Cases	Feeds built to trigger alerts with context
🔁 Monthly Feed Review	Optimization for shifting threat landscape

---

📚 9. Real-World Case Studies

🏦 IOC Feeds for Tier-1 Banking SOC

Issue: Existing threat feeds were noisy and generic
Solution:

• Created banking-focused feed (FIN7, IcedID, QBot, etc.)
• Delivered via JSON to Splunk
  Impact:
• 46% reduction in alert fatigue
• 12 high-confidence alerts converted to cases

🌐 Global Retail IOC Bundle

Client: Multinational eCommerce Platform
Feed Customization:

• Botnet command & control IOCs
• Fraud domain URLs
  Results:
• Alert-to-case conversion increased by 28%
• Helped pre-block phishing domains targeting checkout flows

---

🛡️ 10. SOP – Standard Operating Procedure

1. Profile Client Infra & Industry
2. Define IOC priorities & ingestion format
3. Aggregate indicators from trusted sources
4. Filter noise, apply expiry and scoring
5. Package into custom feed bundle
6. Provide API access or file drop
7. Validate integration with SIEM/EDR
8. Deliver monthly enrichment & change logs
9. Conduct quarterly threat review
10. Provide detection engineering advice

---

📋 11. Sample Customized IOC Feed (Preview)

1. Collect IOCs from trusted threat intel sources.
2. Tailor feed based on organization’s vertical.
3. Filter for relevance and recency.
4. Classify IOCs by type (IP, hash, domain, URL).
5. Add context like threat actor, campaign, or motive.
6. Format feeds for integration (STIX, CSV, JSON).
7. Automate feed delivery to detection tools.
8. Enable IOC expiration and validation policies.
9. Monitor usage and false-positive rates.
10. Review and tune feeds periodically.

---

📬 Contact Us or 📅 Book a Consultation