A healthcare provider has just stood up a managed SIEM, an IDS/IPS at the perimeter, and a commercial threat-intelligence subscription. Six weeks in, the SOC reports that high-confidence intelligence indicators are arriving by email but are not influencing detections or blocking decisions in any consistent way. The CISO asks the security architect for the BEST structural fix. Which option should the architect recommend?
- ADirect the SOC to manually review the intelligence emails each morning and raise change requests to add the highest-confidence indicators to the IDS/IPS block list within 24 hours.
- BEstablish a threat-intelligence platform that normalises, deduplicates, and scores indicators, then pushes them via API into the SIEM correlation engine and the IDS/IPS, with a documented confidence-to-action policy. Correct
- CReplace the commercial subscription with a broader open-source intelligence feed so the SOC has more indicators to choose from when writing detection content.
- DAdd a SOAR platform that ingests the intelligence emails, parses indicators, and auto-creates SIEM correlation rules and IDS/IPS block entries based on the email's stated severity.
Why A is wrong: Manual review is slow, inconsistent, and dependent on the diligence of whoever opens the inbox. It also separates the intelligence from the detection context, so analysts cannot tell which alert came from which indicator, making after-action review difficult.
Why B is correct: Correct. A threat-intelligence platform provides the missing middle layer: normalising STIX/TAXII content, deduplicating across sources, scoring confidence, and feeding the SIEM and IDS/IPS through machine-to-machine integration. Coupled with a confidence-to-action policy, it converts intelligence into consistent detection and blocking decisions.
Why C is wrong: Switching feeds does not address the integration gap. More indicators without an ingestion and scoring pipeline simply increases noise, and open-source feeds typically carry lower fidelity than the commercial source being replaced.
Why D is wrong: SOAR can automate response but is the wrong tool for managing intelligence quality. Parsing emails of variable format is fragile, severity in vendor emails is not normalised, and auto-creating rules without confidence scoring or deduplication risks blocking legitimate traffic.