Page History

The second step after enrichment is to run the data against threat intelligence feeds to check if any message or enriched fields/tags get a hit against any of the indicators presented in the feeds.  The threat intelligence feeds are bulk loaded and streamed into a threat intelligence store similarly to how the enrichment feeds are loaded.  The keys are loaded in a key-value format.   The key is the indicator and the value is the JSON formatted description of what the indicator is.  It is recommended to use a threat feed aggregator such as Soltra to dedup and normalize the feeds via Stix/Taxii.  Metron provides an adapter that is able to read Soltra-produced Stix/Taxii feeds and stream them into Hbase, which is the data store of choice to back high speed threat intel lookups of Metron.  Metron additionally provides a flat file and Stix bulk loader that can normalize, dedup, and bulk load or stream threat intel data into Hbase even without the use of a threat feed aggregator.