Tifce Workbook

This query is a comprehensive Kusto Query Language (KQL) notebook designed to evaluate the effectiveness of threat intelligence feeds in a security environment. Here's a simplified breakdown:

1. Parameters Setup: The notebook starts by defining several parameters to filter and customize the data:

   • DefaultSubscription_Internal: Retrieves the subscription ID for operational insights workspaces.
   • InternalWSs: Extracts workspace information from security incidents.
   • Subscription: Lists subscription IDs and highlights the default one.
   • Workspace: Filters workspaces based on the selected subscription.
   • TimeRange: Sets the time range for data analysis, defaulting to the last 30 days.
   • InternalRG: Retrieves the resource group for a specific workspace.

2. Introduction: The notebook introduces the concept of Threat Intelligence Feed Content Evaluation (TIFCE), which assesses the value of threat intelligence feeds based on their behavior in real security telemetry.

3. Threat Feeds Overview: Displays a summary of connected threat intelligence feeds over the last 30 days.

4. Pillar 1 - Originality: Evaluates how unique the indicators from each feed are, rewarding feeds that provide exclusive indicators not found in others.

5. Pillar 2 - Environmental Relevance: Measures whether the indicators from the feeds are actually present in the organization's telemetry, indicating their relevance to the environment.

6. Pillar 3 - Signal Versus Noise: Assesses whether detected indicators are true threats (true positives) or false alarms (noise), based on their association with closed security incidents.

7. Pillar 4 - Freshness: Determines how up-to-date the feeds are by analyzing the recency and frequency of indicator updates.

Each section includes queries that process data from various security logs and telemetry sources to calculate scores and metrics for each pillar. The results help organizations identify the most valuable threat intelligence feeds, reducing noise and improving detection capabilities.