Mastodawn

@claushoumann folks like Jerry Gamblin have argued for a while that most teams don’t have a need and certainly aren’t equipped to actually use most CTI (like Jerry has argued that attribution is likely useless for most purposes).

This aligns with my thoughts as well: most teams have no intel loops, have no output consumers, no real need for most TI products, beyond maybe some RFIs during certain operation types.

Turns out maturity models still ruin everything around us…

@lojikil I must admit I on the same of the fence here. I see much money spent, frw results/outcomes and even less actionable

@claushoumann I think we need to measure ourselves on eg Hunt Maturity Model and be honest about what our capabilities are vis-à-vis our budget. I think you’re right, we don’t really need it for most shops. Heck, @circl probably provides enough for most folks needs, if they even have a need.

@lojikil @circl probably MISP is enough for everyone by itself yea. Hunt maturity model?

@claushoumann @circl it’s a model for measuring how mature your threat hunting (and other processes) are internally to an org. This is a decent treatment: https://hunt.io/glossary/sqrrl-threat-hunting-framework

Sqrrl Threat Hunting Framework: A Complete Guide

Uncover the Sqrrl Threat Hunting Framework. Learn the key techniques and best practices to proactively hunt for threats and bolster your security.

@lojikil @circl Can I be honest?

I hope I can and will presume it. This framework is not bad at all, but its inferior to #OpenTIDE by a lot :).

@claushoumann @circl you always can! It’s also much older than OpenTIDE, but we probably need to do more evangelism of the latter here!

@lojikil @circl on that note, I am waiting for the release blog but last night they released #ShareTIDE -> the first 200++ TLP:CLEAR TVM models, see OpenTIDEHQ on Github!

Lojicholia enshrines triumph Oct 4, 2025

@claushoumann @circl oh heck yes, let me look!