R-Vision Threat Intelligence Platform (TIP) by R-Vision provides automated collection, normalization, and enrichment of indicators of compromise, direct transmission of processed data to internal protection tools, and search and detection of indicators within the organization's infrastructure using sensors. It simplifies working with Threat Intelligence data by collecting, normalizing, and storing data from various sources in a single database. It facilitates the detection of hidden threats by providing automatic monitoring of relevant indicators in SIEM streams using sensors. It simplifies and accelerates incident investigation through quick information retrieval from available sources and automation of key cyber intelligence data workflows. It enables timely threat blocking and minimizes potential damage by automatically exporting processed data directly to internal protection tools. R-Vision TIP centralizes the collection of indicators by aggregating threat data from various sources automatically. The system has built-in integration with threat intelligence platforms and services: Group-IB Threat Intelligence, Kaspersky Threat Intelligence, RST Cloud Threat Feed, BI.ZONE ThreatVision, AT&T Cybersecurity, ASOI FinCERT, MITRE ATT&CK®, and R-Vision Threat Feed, with the option to connect other sources. R-Vision Threat Feed is a separate service that automatically collects and processes TI reports from open sources, extracts indicators of compromise and related context, and transmits data to the system. When connecting R-Vision Threat Feed to the platform, the analyst receives information about all important objects related to the report: indicators of compromise, attackers, malware, and other context. The report data can be analyzed and used for searching within the organization's infrastructure or for integration with protection tools. R-Vision TIP allows enriching compromise indicators with additional context not present in the original data from the provider. It supports over 20 enrichment services: VirusTotal, Whois, RiskIQ, Ipgeolocation.io, Hybrid Analysis, OPSWAT Metadefender, Shodan, RiskIQ, MaxMind, and others. Relationship analysis helps cybersecurity specialists interpret data and form a comprehensive threat picture. R-Vision TIP collects available information from the provider about indicators and related data: malware; vulnerabilities (CVE), list of vulnerable software (CPE), security defects (CWE); reports; threat actors; techniques, tactics, and other context from MITRE ATT&CK®; other indicators. Processed data is automatically sent to existing internal protection tools from a unified database for immediate blocking. Preprocessing helps reduce false positives that may occur when using raw data. Automatic export of indicators is supported on equipment: UserGate; Cisco; PaloAlto Networks; Check Point; McAfee; Ideco UTM; and other security tools. The system provides retrospective and proactive search for relevant indicators in SIEM events and sends alerts upon their detection: QRadar; ArcSight; MaxPatrol SIEM; Apache Kafka; Smart Monitor; other SIEM systems. R-Vision TIP automation allows the implementation of necessary workflows with indicators as a sequence of actions. Actions can include: context enrichment in external services, data normalization, monitoring in SIEM events, alerting upon detection, and exporting indicators to protection tools. A convenient bulletin builder enables the creation of custom informational materials to raise awareness among various stakeholders. With the bulletin constructor, you can create bulletins on threats and vulnerabilities, add additional evidence such as images and annotations, distribute bulletins to subordinate structures, and export them to external systems via API. Integration with MITRE ATT&CK and custom configuration of compromise indicator rating calculation. R-Vision TIP is certified by the Federal Service for Technical and Export Control of Russia at level 4 of trust.
