In the presentation that threat intel vendors do not want you to see, threat data from open source and home grown resources meets Evernote as the ultimate braindump repository with the outcome of producing real actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses an experiment of using Evernote as a informal threat intelligence management platform, the specific concepts and strategies used, and its overall effectiveness. Specific topics covered include the advantages of using an open and flexible platform that can be molded into an open/closed source threat data repository, an information sharing platform, and an incident management system. Although using Evernote in this way in large enterprises is probably not possible, organizations can apply the same reference implementation to build similarly effective systems using open source or commercial solutions. And yeah … threat intel vendors still hold a role in ultimate threat intelligence nirvana but there is a lot you should do on your own first in order to better understand your requirements in searching for that ideal partner.

1. Creating REAL Threat Intelligence
with Evernote
@grecs – NovaInfosec.com

2. Disclaimer
Opinions expressed are solely my own and do
not express the views or opinions of my
employers, customers, etc.
NovaInfosec.com@grecs,

3. NovaInfosec.com@grecs,

4. 20 Yrs Industry
16 Yrs Infosec
5 Yrs SOC

5. NovaInfosec.com@grecs,

6. Consulting
• 20 Years
Industry/Infosec
Experience
• Security Engineering/
Architecture
• SOC 2.0/Transformation
• Security Training
NovaInfosec.com@grecs,

7. Agenda
• Premise
• Beginnings
• Pivot
• 3 Legs of Threat Intel
• Evernote as an Intel Repo
• Alternatives
• Future
NovaInfosec.com@grecs,

8. PREMISE
Over Engineering
Build (at least try to) Before Buy
NovaInfosec.com@grecs,

9. Premise
Over Engineering
• Tendency to Over
Complicate
• Keep It Simple Stupid
• What Can We Do Quick &
Dirty that Will Get Us 60-
70% of the Way There?
• Onboarding Workflow
System Example
Solution Fine As Is
Est. Requs. to Develop Eventual Solution

10. Premise
Build (at least try to) Before Buy
• Before Buying New Commercial Solution
– Try Quick & Dirty Solution In-House First
• Use Tools Already Have & All Familiar With
• Setup Good Set of Processes Since Lacks Safety Checks
• Have Smart People Actually Use Solution for 6-12 Mos.
• Continually Evolve Processes with Lessons Learned
– Maybe that Will Solve Your Needs
– Else Understand What REALly Need  Commercial
• Invest in People & Process 1st, then Products
Case In Point:Threat Intel Services
NovaInfosec.com@grecs,

11. BEGINNINGS
Dashboard 1.0
Dashboard 2.0
Dashboard 3.0
Take-Aways
NovaInfosec.com@grecs,

12. Beginnings
Dashboard 1.0
• SOC Security Engineer Position
Many Years Ago Working to Create
Dashboards
• Wanted to Measure Risk
• Use Traditional Risk Equation
– Vulnerability Data Based on
Patch & Other Tools
– Threat? Decided to Use Vendor
Threat Levels (e.g., SANS INFOCON,
Symantec – normalize and average)
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

13. Beginnings
Dashboard 2.0 – Google Reader, iGoogle, Feedly

14. Beginnings
Dashboard 3.0
• Moved from Feedly
to Netvibes Since
Designed Ground
Up as Dashboard
• Added “Cyber
Intel” Tab with
Sources Still
Active from Feedly
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

15. Beginnings
Dashboarding Take-Aways
• Nice for “Blog” Post Feeds
• Tough to Follow for Data-Driven Feeds
– Changing Too Fast
– Feedly Pro
– NetVibes VIP
• Keep All Feed Data & Searchable
• Expensive for One-Off Analyst Resource
• Introduce Concept of One “Bucket” to Dump All Into
• Doesn’t Work for Periodically Updated Data Files
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

16. PIVOT
Meanwhile…
Rebaseline
The Secret Weapon
Ah Ha
NovaInfosec.com@grecs,

17. Pivot
Meanwhile…
• Threat Intel Market Growing
– Investigating Threat Intel
– Consulted Experts & Users of Threat Intel Services
• Basic Take-Aways
– Fascinating Area with Lots of Cool Things Mathematically
Correlated Together in Some Fancy Big Data Model
– Not Much Value Beyond Open Source Resources
– A Lot of Data Not Relevant to Organization
• Dashboard
– Was onto Something
– Pulling all Open Source Info Together
NovaInfosec.com@grecs,

18. Pivot
Rebaseline
• NetVibes VIP but Cheaper & More Flexible
• Bucket to Dump All Data Into
– Blog/Other Feeds
– Data-Driven Feeds
– Data Files
– Other (anything else find – e.g., APT reports)
• Easily Find Data
– Searchable
– Categories
– Tagging for Viewing in Different Ways
• Cloud-Based So Wouldn’t Have to Maintain & Accessible
Everywhere
– Email Folder (like in old days but too kludgy)
– Log/Data Aggregation Tools
NovaInfosec.com@grecs,

19. Pivot
The Secret Weapon
• Method for Using Evernote as GTD-Based Task Mgmt
System
– Treat Evernote Like a Database
– Notebook == Table
– Note == Free Form Record
• Organization
– Nested Notebooks
– Hierarchical Tagging (provide metadata structure)
• What  Projects
• When  Importance – e.g., 0-6
• Where  E.g., home, work, etc.
• Who  E.g., people that action has to do with
• Combination Above
• Search
– ~ Notebook, Tag, Keyword, or Combination Thereof
– Saved Searches
NovaInfosec.com@grecs,

20. Pivot
The Secret Weapon – Customization
• Identifier Symbols
for Each W*
Category
• Carry Through of
W* Symbols into
Sub-Tags
• Included “.” after
Symbols to Mark
Headings
NovaInfosec.com@grecs,

21. 3 LEGS OF THREAT INTEL
Open Source Intelligence
Information Sharing
Case Tracking
Existing Solutions
NovaInfosec.com@grecs,

22. 3 Legs of Threat Intel
Open Source Intelligence
• Boils Down to
– Indictors (e.g., IPs, Domains , URLs, Hashes, Email Addresses, … )
– Reports (e.g., vendor dossiers on threat TTPs)
• Historically Lots of Open Source Resources
– MalwareDomainList
– Zeus Tracker
– SSL Blacklist
– …
• Don’t Forget Social Networks (e.g., certain people/resources on Twitter)
• Mix in Organizational Data as Well to Enrich (e.g., honeypots)
• Commercial (but let’s get the free stuff down first to define requirements)
• Big Need
– Centralized Database to Record All this Information
– Mmm? Perhaps a Shared Evernote Notebook Using Tags to Track?
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

23. 3 Legs of Threat Intel
Intel Sharing
• Groups
– ISACs (FS-ISAC, MS-ISAC, DIB-ISAC, …)
– DIB
– Infragard
• Historically
– Email List
– Bulletin Boards
• Big Need
– Centralized Database to Record All this Information
– Mmm? Perhaps a Shared Evernote Notebook Using
Tags to Track?
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

24. 3 Legs of Threat Intel
Case Tracking
• Pretty Simple with Many Workflow Systems Out There
– Open New Case
– Work It Periodically Adding Comments of What Done
– Eventually Gets Closed
• Many Existing Solutions
– Remedy
– RT
– SharePoint
• Big Need
– Centralized Database to Record All this Information
– Mmm? Perhaps an Evernote Notebook using Tags to Track?
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

25. 3 Legs of Threat Intel
Existing Solutions
• Open Source Intelligence
– Open Source: CRITS, CIF
– Vendors Incorporating into Products
• Intel Sharing
– Email Lists, Bulletin Boards
– Starting to Distribute in Standardized Format (TAXII, STIX)
• Case Management
– Open Source: RT, eTicket, Help Desk Lite, …
– Commercial: Remedy, SharePoint
• All-In-One
– ThreatConnect (free to join; in cloud and on-premises)
• Overall
– Lots of Point Solutions But Not Flexible
– Ease of Use (CEO down to analyst)
– Centralized Database to Record All this Information
Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,

26. EVERNOTE AS AN
INTEL REPO
Ah Ha
OSINT
Intel Sharing
Case Tracking
Summary
Other Tricks
EN Search
Alternatives
NovaInfosec.com@grecs,

27. Evernote as an Intel Repo
Ah Ha
• Define Notebooks & Hierarchical Tags for Metadata
• Perfect Open & Flexible Framework to Build Off Of
• Easy to Use Over Heavy Database or Workflow
Management System
• Start Dumping All Feeds/Data into Evernote Bucket
Dashboarding + Secret Weapon + Threat Intel
= Evernote as an Intel Repo
NovaInfosec.com@grecs,

28. Evernote as an Intel Repo
OSINT
• Archive of Organization Relevant Data from Open
Source Resources
• Benefits
– Database Can Search and Pivot Around In
– Annotation of Notes
• Dumping
– Automated via Feeds
– Clip into Evernote with Browser Add-On
• Recommended Tagging Structure
NovaInfosec.com@grecs,

29. Evernote as an Intel Repo
OSINT
• Threat Data/Intel
– MalwareDomainList (RSS feed)
– Zeus Tracker (RSS feed)
– SSL Blacklist (RSS feed)
– Malware-Analysis Traffic (RSS feed)
• Vulnerability
– Offensive Security Exploit Database
(RSS feed)
– NIST NVD CVE (RSS feed)
– US CERT All Products (RSS feed)
• Situational Awareness
– SANS ISC Blog (RSS feed)
NovaInfosec.com@grecs,

30. Evernote as an Intel Repo
OSINT
NovaInfosec.com@grecs,

31. Evernote as an Intel Repo
OSINT - Automation
• Email into Evernote
– Sign Up for Service Using Evernote Email
• IFTTT/Zapier for RSS Feeds
– Easily to Implement
– Limit of Only Getting Partial Data
– Write Own RSS Scraper / FiveFilter
• IFTTT/Zapier with Email Integration
– Helps Some if Offer Mailing List with Full Data
• StormStack - Open Source Clone+ of IFTTT
• Scripts
– E.g., Retrieve Files & Insert into Evernote
• CIF Feeds
NovaInfosec.com@grecs,

32. Evernote as an Intel Repo
Intel Sharing
• Intel Sharing
– Shared Evernote Notebook for Partner Group
– Create Note, Place in Shared Notebook to
Distribute, & Use Standard Tags to Track
• Case Tracking
– Evernote Notebook with a Note per Investigation
– Establish Note Template with
– Tags to Id Workflow (e.g., Open, Working, Closed)
NovaInfosec.com@grecs,

33. Evernote as an Intel Repo
Summary
!.When ].What @.Where ^.Who
Case
Tracking
!.Case Tracking
!High
!Medium
!Low
** ].Case Tracking
]CAS10000
]CAS10001
…
@.Case Tracking
@Inbox
@Working
@Closed
^.Case Tracking
Intel
Sharing
** ].Intel Sharing
]SHA10000
]SHA10001
…
@.Intel Sharing
@New
@Relevant
@Irrelevant)
^.Intel Sharing
^FS-ISAC
OSINT
DB
** ].OSINT DB
]OSI10000
]OSI10001
…
@.OSINT DB
@New
@Useful
@Useless
^.OSINT DB
^NIST
^Abuse.ch
…
Only Tag if Relevant Primary Tags (**) Used to Cross-Ref
Source or Who
Added/Upd
Workflow or
State
Reference
Number
Priority,
Confidence, Rep

34. Evernote as an Intel Repo
Other Tricks
• Create New Meta-Notes that Pull Together
Existing Notes (e.g., several OSINT notes, intel
from partners, and cases assigned)
• One-Off “Other” Tags to Pull Together Any
Notes
• Alternative Tagging Structures: Adversaries,
Campaigns, Waves, Individual
Attacks, Indicator DB, …
NovaInfosec.com@grecs,

35. Evernote as an Intel Repo
EN Search
• How to Find Find All Data Threw into Evernote
• Tags
• Basic Search
• Advanced Search
– Specific Notebooks, Tags, Terms, Dates
– “AND” Boolean Support
• Example
– Search for IP & Find Note
– Run Secondary Search Around that Timeline
– Discovery Similar Happenings
• Saved Searches (e.g., Case Tracking)
NovaInfosec.com@grecs,

36. Evernote as an Intel Repo
Alternatives
• Log Management Solutions
• SIEMs
• Others

37. Evernote as an Intel Repo
Future
• More/Improved OSINT Resources
– Deconflict Sites with Multiple Feeds & Add if Needed
– File Base Pulls (script / replace existing RSS)
– Vendor APT Reports
– News Blogs - Track Happenings Around Specific Period
– Integration with CIF to Centralize/Tag Data
• Improved/Formalized Tagging Structures
• API Automation (e.g., auto tagging IP addresses)
• EaaS (Evernote as a SIEM ;) )

38. Conclusion
• Lots of Point Solutions but
None Bring Together Like
Good ‘ol Evernote
• Start with Evernote to
“Figure Stuff Out"
• In End Determine REAL
Requirements
– Solution Fine As Is
– Build In-House/Buy
Commercial Full Out
Solution
NovaInfosec.com@grecs,

39. Questions?
• Twitter @grecs
• Website NovaInfosec.com, @novainfosec
• Contact http://bit.ly/nispcontact
o Questions/Consulting