Question

A financial services company subscribes to five commercial and open-source threat intelligence feeds. Analysts are overwhelmed with thousands of daily indicators, most of which relate to industries and technologies the company does not use. Leadership wants to improve the actionability of threat intelligence without simply cutting feeds. Which action would MOST effectively increase the value of the enterprise threat intelligence program?

Accepted Answer

Correlate incoming indicators against the organization's asset inventory, technology stack, and industry sector to prioritize relevant intelligence

Answer

Configure the SIEM to automatically block every indicator from all five feeds to ensure no threat is missed

Answer

Cancel the two lowest-cost feeds and retain only the most expensive commercial subscription

Answer

Increase the retention period of raw indicator data so analysts can review historical feeds during quarterly reviews