Cortex XSOAR - Best Practice Optimize Threat Intelligence Management (TIM)

[A.Faruq]

Dear Community,

I read the documentation about Threat Intelligence Management (TIM) from this article before https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/what-is-everyone-doing-with-their-tim-.... However, that document is not updated, and there is no mention of best practices for managing TIM efficiently.

I have a case also when integrated the Cortex XSOAR with Threatfusion from SOCRadar and when I checked the integration. There are so many false positive detections from Threatfusion that waste the remaining credit checks by checking unnecessary things like internal ip or naming field below.

Where is the menu that I can optimize TIM like manage allowlist (Exception), or show what command was used before to manage and keep credits from Premium Threat Intelligence like Threatfusion.

Thanks

[michaelsysec242 · Accepted solution]

Hello @A.Faruq ,

I would recommend you create a series of delete and exclusions for private IP ranges using their subnet range definition in addition you can exclude organizational domains as these may offer little benefit as an indicator. I would recommend reading the recommendation for this from the Palo Docs.

In regards to managing the premium Threat Intel integration, you can work out how to limit it for only suitable indicators of a specific types.

Link to Docs 

I hope this helps you to understand how to manage this correctly. 

Many thanks,

MichaelSysec