c4.6 Build threat intelligence
Form a threat-intelligence capability that studies local and global threats, actors, tactics, and indicators of compromise (IoCs), then feeds that intelligence into your security services — GuardDuty threat lists, AWS WAF reputation rules — to detect and block known-bad activity.
Implementation guidance
Study, then feed the intelligence back in
A threat-intelligence function studies security news, threat actors, tactics, and indicators of compromise (IoCs), and — crucially — feeds what it learns into your security services so detection improves.
Enrich GuardDuty with your own IoCs
Amazon GuardDuty already uses Amazon's intelligence plus third-party and open-source feeds. You can add your own trusted IP and threat IP lists — for example malicious IPs seen attacking your on-premises environment, or IoCs from a commercial feed (such as Talos, X-Force, or Mandiant). Supported formats include plaintext, STIX, and several CSV feed formats.
Reputation controls at the edge
AWS WAF managed rules include Amazon IP reputation and anonymous-IP lists that cut attacks from known-bad botnets and anonymizers; partner reputation feeds on the AWS Marketplace extend these. The AWS WAF Security Automations solution adds feeds such as Spamhaus and Emerging Threats.
Generate your own signals
A mature team can run honeypots and decoys to gather fresh, first-party intelligence. See detecting suspicious activity with private decoy resources.
How to validate
- Do you feed indicators of compromise (for example from a local CIRT or attacks on your on-premises) into GuardDuty threat lists?
- Are third-party threat-intelligence feeds integrated into your detection and WAF?
- Do you have a threat-intelligence function, and do you use honeypots/decoys to learn about adversaries?
Threats addressed
- Without current threat intelligence fed into detection, your controls miss known-bad IPs, domains, and techniques that other organizations are already seeing.
AWS services
Amazon GuardDuty 
AWS WAF