🛡️ Sherlocked Security – Tactical Threat Feeds (CTI Integrations)
Real-Time Threat Intelligence You Can Plug Into Your Defenses
📄 1. Statement of Work (SOW)
Service Name: Tactical Threat Feeds (CTI Integrations)
Client Type: SOC Teams, MSSPs, Threat Hunters, Enterprises, Government Agencies
Service Model: Real-Time IOC Delivery + Custom Feed Tuning + Platform Integration
Compliance Coverage: MITRE ATT&CK, ISO 27001, NIST, SOC 2
Feed Types:
- Malicious IPs, URLs, Domains
- Malware Hashes, TTPs, IOCs
- CVE Exploit Timelines
- Custom Vertical/Geo Feeds
🧠 2. Our Approach (with Visual)
🔹 IOC-First, Noise-Reduced Feeds
🔹 Platform-Ready JSON/STIX 2.1 Formats
🔹 MITRE-Aligned Correlation Support
[Threat Collection] → [Normalization & Enrichment] → [TTP Mapping] → [IOC Filtering & Tagging] → [Feed Formatting (STIX, JSON)] → [Platform Integration] → [Client Dashboard & Alerts]
🧪 3. Methodology (with Visual)
[Client Intake & Tech Stack Review] → [Threat Feed Subscription Setup] → [Source Enrichment & De-duplication] → [IOC Tagging & Expiry Logic] → [Integration Format Prep] → [Threat Feed API Access] → [Dashboard Setup & Alerting] → [Monthly Refinement Feedback]
📦 4. Deliverables to the Client
- ✅ Real-Time Threat Feed API Access
- 🧾 CTI Integration Guide (PDF/JSON)
- 🧭 IOC Enrichment Ruleset
- 📘 IOC Feed Bundle including:
- IPs, Domains, URLs
- Hashes (MD5, SHA1, SHA256)
- Threat Actor Tags
- MITRE TTP Mappings
- Expiry & Confidence Ratings
- References
- 📊 IOC Trends by Region/Industry
- 📽️ CTI Platform Demo & Integration Support
- 🧑💻 Threat Analyst Support for Correlation
- 🔁 Monthly Feed Optimization Review
- 🎓 Threat Feed Validation Certificate
🤝 5. What We Need from You (Client Requirements)
- ✅ SIEM/XDR/EDR platform details
- ✅ Required feed types (IOCs, Malware, CVEs, etc.)
- ✅ Ingestion format preference (STIX, JSON, CSV)
- ✅ API credentials if integration is needed
- ✅ Priority sectors, regions, or threat actor focus
- ✅ Contact for onboarding and tuning reviews
🧰 6. Tools & Technology Stack
- 🧠 Threat Intel Platforms (MISP, AlienVault OTX, IntelX)
- 🔍 IOC Management Engines
- 📡 STIX/TAXII Servers
- ⚙️ JSON/STIX/XML Formatters
- 📊 Correlation Dashboards (Elastic, Splunk, QRadar)
- 🔬 IOC Expiry & Confidence Scorers
- 📁 Custom API Gateways (Sherlocked CTI Core)
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Client Inquiry & Briefing 2. Tech Stack Mapping 3. Feed Requirement Collection 4. Format/Platform Integration Setup 5. Threat Feed API Access Shared 6. Tuning and Enrichment Cycle 7. Client-Side Integration Validation 8. Monthly IOC Review & Update 9. Final Feed Certification & Maintenance Plan
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| ⚡ Low-Noise Feeds | Curated, high-confidence IOCs with expiry logic |
| 📘 Plug & Play Formats | STIX 2.1, JSON, CSV ready for SIEM/XDRs |
| 🧠 MITRE TTP Alignment | Feeds tied to known actor behaviors |
| 📡 Real-Time Delivery | API-based push or scheduled pull integration |
| 🔁 Monthly Optimization | IOC pruning, actor update, trend mapping |
📚 9. Real-World Case Studies
🧬 Real-Time IOC Integration into Financial SOC
Client: Tier-1 Indian Bank
Findings:
- Massive IP blocks and malware hashes related to DarkGate loader
Outcome: - IOC feed integrated into Splunk
- Triggered block rules across 4 firewalls
- Real-time threat dashboard created for SOC Tier 1 analysts
💡 Threat Feed for Nation-State Phishing Kit Mapping
Client: National CERT
Findings:
- Nation-state actors reusing IP infrastructure
Outcome: - Correlated TTPs with STIX feed
- Prevented 2 major spear-phishing campaigns within 72 hours
🛡️ 10. SOP – Standard Operating Procedure
- Initial call and tech environment review
- Feed type and format discussion
- Integration method (push/pull/API) finalized
- Access and authentication setup
- IOC feed sharing begins
- Internal validation by client SOC/EDR/SIEM
- Analyst support for alert tuning
- Monthly IOC deprecation and update
- Threat trend reporting optional
- Final integration walkthrough
📋 11. Sample IOC Feed Format (Preview)
- Collect IOCs from trusted threat intel sources.
- Tailor feed based on organization’s vertical.
- Filter for relevance and recency.
- Classify IOCs by type (IP, hash, domain, URL).
- Add context like threat actor, campaign, or motive.
- Format feeds for integration (STIX, CSV, JSON).
- Automate feed delivery to detection tools.
- Enable IOC expiration and validation policies.
- Monitor usage and false-positive rates.
- Review and tune feeds periodically.