ThreatQ Investigations

ThreatQ Investigations is a cybersecurity situation room that enables collaborative threat analysis, investigation, and coordinated response. Investigations is built upon a collaborative investigation interface that aggregates all information on screen with a focus on the evidence board, which displays threat intelligence data as icons.

ThreatQ Investigations is built on top of the ThreatQ threat intelligence platform and allows for capturing, learning, and the sharing of knowledge. This results in a single visual representation of the complete investigation at hand, who did what and when, based on a shared understanding of all components of the investigation: threat data, evidence, and users.

The following describes the components of an investigation and how it can be used to drive an incident response.

Evidence Board

The evidence board provides a visual representation of the threat intelligence data you are currently investigating.

The evidence board allows you to:

• Fuse together threat data and user actions to more quickly determine the right actions to take.
• Accelerate investigation, analysis, and understanding of threats in order to update your defensive posture proactively.
• Drive down mean time to detect (MTTD) and mean time to respond (MTTR).

Action Panel

Using the action panel, incident handlers, malware researchers, SOC analysts, and investigation leads gain more control, and are able to take the right steps at the right time.

The action panel allows you to:

• See how the work of others impacts and extends your own.
• View a summary of any aspect of the evidence board that currently has mouse focus.

Timeline

You can build incident, adversary, and campaign timelines to accelerate understanding of threat intelligence data. The timeline portion of an investigation allows you to visualize how the investigation began and understand how the response unfolded.

You can view:

• When indicators, events, adversaries, files, signatures, and so on were discovered and included in the Threat Library.
• Any assigned and closed tasks.
• Who was working on what aspect of the investigation and when.