Summary

In this chapter, you learned about the importance of threat intelligence and how it can be used to gain more information about current threat actors and their techniques and, in some circumstances, predict their next step. You learned how to leverage threat intelligence from the open source community based on some free tools, as well as commercial ones.

You learned how to use the MITRE ATT&CK framework and the MITRE ATT&CK Navigator to understand adversaries’ behavior and how they are leveraging different techniques and subtechniques for their operations.

Next, you learned how Microsoft integrates threat intelligence as part of its products and services, and how to use Microsoft Sentinel not only to consume threat intelligence, but also to visualize potentially compromised features of your environment based on the threat intel acquired, compared to your own data.

In the next chapter, we will continue talking about defense strategies, but this time...