Threat Intelligence has, for a long time, only been within reach of very large organisations or security teams. Often there is a lot of waving hands and huge dollar values thrown around when talking about threat intelligence. Six month timelines for deploying some technology that is inaccessible to the seething masses or 老百姓 (Mandarin for masses).
If you like LOVE the practise of Cybersecurity, you might posess a burning curiosity for details about your cyber-adversaries. You’re not content for someone else to tell you what is a threat and what isn’t. You’re curious - what if we just pay attention to information we already have, like phishing attacks and other low hanging fruit, and extract value from that?
Can we do this? Start small. Operationalise the lower order indicators (IP addresses). Get this out to customers and industry peers. Add higher order indicators (dns). Iterate.
We can do this!
Easy Intel is the outcome of that curiosity. Easy intel is about making cyber threat intel accessible. All you need is a $50 router and you can use Easy Intel today!
I’m busy, why bother?
Here are 5 reasons you should care:
- It’s free, easy and quick to deploy.
- Our intel is of high quality and low false positive rate
- The IPs in our list are nasty. You don’t want them near your systems!
- We’re Aussie - support made in Australia!
How do I get started?
- Visit Easy Intel
- Click “Get Feeds” - choose your platform
- Choose from the high / med / low confidence feed, depending on your risk tolerance.
- We provide raw IP lists that you can use on most good platforms (pfSense, OPNSense and Mikrotik). You can also use it on Fortinet or Watchguard devices.
- Add the URL to the block list in LOG mode for a period to test
- Once you’re tested the list, change the firewall policy to DROP + LOG.
What about
False positives We’re working on adding MISP style warninglists to reduce common false positives. We’ve been running easy intel on a number of sites for the past 3 months and the false positive rate for the high confidence feed is very low.
Customization We anticipate that there will be an almost immediate need for custom lists and a feedback mechanism. We’re happy to build this if we see adoption of the tool. We will probably build it for ourselves even if there is no demand to be honest!
This is too simple
We know. We’re on a journey to a full suite of cyber threat intelligence but if we can’t mobilize intelligence that is free and cheap to operationalize, then it is going to be nigh on impossible to deliver real intelligence. We know that there is a mismatchin in our target market - SMB doesn’t need intel, at least as much as those who can pay for it.
This is not just about you (sorry), it is also about us. We’re developing our technology and sources and we will be well placed to deliver high quality bespoke phishing intelligence soon. When we have that in hand, we will be able to offer real intelligence to those who are in the market for it!