Problem: The large variety of sources and the amount of information about threats make it difficult or impossible to process and manage them manually.

Solution: SSAP acts as a platform that automatically collects, processes, and prepares threat information for delivery to security devices. It has the ability to collect threat information from a large number of different types of sources. These can be both public and paid sources that require authorization when accessing them. It then filters and normalizes the resulting data by cleaning up duplicate, malformed, and invalid VirusTotal and Whitelist items. According to the configured parameters, it prepares customized and clean lists of threat indicators that enrich the security devices.

Result: The burden on security personnel is reduced by automating the processes for collecting and analyzing IoCs.

Problem: A high number of false positives compromises the effectiveness of safety devices.

Solution: With SSAP, it is possible to minimize the number of false positives on security devices, this is achieved by centrally managing lists of indicators of compromise, having whitelists of allowed indicators, and additionally checking each indicator on VirusTotal. This allows you to keep the most "valid" indicators of compromise in the SSAP database, which will be used by security devices such as SIEM systems, firewalls, antiviruses, etc. in the future.

Result: Zero or minimal number of false positives on security devices, which allows you to save time investigating "false" incidents, as well as guarantee that services required for the company's work will not be blocked in the event of an error on the part of the security list vendor.

Problem: The company is becoming a victim of frequent hacking by cybercriminals, and this is becoming the norm, not the exception. Response to such attacks requires prompt and well-coordinated measures.

Solution: The Smiddle Security Administration Platform system uploads information about potentially dangerous artifacts (IoC) to a centralized SSAP database on a schedule or on demand, allowing you to receive updated data from the source as soon as it appears. From the SSAP database, data is quickly transferred to the required security devices. This will allow prompt responses to cyber-attacks and reduce their impact on the organization, avoiding their spread on critical workstations and the organization's network.

Result: Increased speed and efficiency of response to incidents during a cyber-attack will help reduce its negative impact on the organization.

Problem: Not being able to directly manage the load of IoCs on security devices can reduce their effectiveness.

Solution: Each security appliance is limited in understanding only certain types of indicators of compromise and has limited resources to process and store them. This can lead to some indicators being ignored if there are too many of them or if they are incompatible with a particular security tool. However, thanks to the Middle Security Administration Platform (SSAP), this problem is solved. With SSAP, you can manage the effectiveness of Threat Intelligence functionality on your security devices by configuring specialized rules. These rules allow you to create appropriate lists of indicators of compromise for each type of security device so that they receive only those indicators that they understand and can handle effectively. It is also possible to limit the number of indicators to the maximum possible volume that these tools can store.

The result: Increased efficiency of the Threat Intelligence functionality on security tools, which allows you to better protect the company from cyber threats.

Problem: Lack of understanding of the effectiveness and quality of each source of indicators of compromise used by the organization.

Solution: Organizations may use a large number of sources with indicators of compromise; some of them may be free and some may be paid. However, there is no objective view of how effective each source of indicators is for a particular organization. SSAP enables you to understand this. Using SSAP algorithms, metadata (number of indicators, duplicates, whitelists, triggers, etc.) of each source and security device is analyzed. After analysis, each source is assigned a certain score that reflects its real benefit to the organization at specific time intervals.

Result: Each source of indicators of compromise has its own objective assessment of effectiveness and quality, which allows you to understand its usefulness for each specific organization.