How AlertZero builds threat reports

A threat report is an article about threat activity from a public threat feed, along with the details AlertZero extracts from it, such as indicators of compromise (IOCs). The Continuous Threat Hunt Worker searches your data for activity that matches each report. AlertZero builds the reports for you, so you don't need to set up the feeds yourself.

When you turn on Continuous Threat Hunt, AlertZero turns on three threat intelligence supply workflows. Ingest threat feeds and Enrich threat report each run every 4 hours in the default space. Attribute alerts to reports runs every hour in the current space.

Enrich threat report works on the reports that Ingest threat feeds saves:

  1. Ingest threat feeds collects new articles from the supported threat feeds and saves each one as a threat report. It skips articles more than 30 days old and articles it already collected in the last 90 days.
  2. Enrich threat report checks that each report contains threat intelligence, then extracts details such as IOCs, attacker behaviors, and severity. Continuous Threat Hunt ignores reports that fail the check. For the full list of details, refer to How AlertZero builds threat reports > What a threat report contains.

Attribute alerts to reports counts the alerts that match each report.

Tip

After you first turn on Continuous Threat Hunt, Enrich threat report might need several runs to process all the collected reports. It processes up to 50 reports per run, oldest first. Until then, Continuous Threat Hunt hunts with only the reports processed so far.

For each threat report that contains threat intelligence, Enrich threat report adds the following details:

  • IOCs, including file hashes, IP addresses and ranges, domains, URLs, email addresses, and cryptocurrency wallet addresses.
  • A classification of the threat, including its categories, attacker behaviors, affected regions, and severity.
  • A description of the adversary, including their capabilities, infrastructure, and victims, if the report has enough detail.
  • Links to other reports that share its IOCs.

Ingest threat feeds checks these public feeds for new articles. You can't add your own feeds. The list is fixed. To reach the feeds, Kibana needs outbound HTTPS access to each feed's domain. Kibana connects to the feeds directly, not through a proxy.

Feed Publisher Domain
Elastic Security Labs Elastic www.elastic.co
CISA Alerts and Advisories U.S. Cybersecurity and Infrastructure Security Agency (CISA) www.cisa.gov
UK National Cyber Security Centre UK National Cyber Security Centre (NCSC) www.ncsc.gov.uk
CERT-FR Security Alerts French national CERT (CERT-FR) cert.cyber.gouv.fr
CERT-FR Threats and Incidents CERT-FR cert.cyber.gouv.fr
CERT-EU Security Advisories CERT for the EU institutions (CERT-EU) cert.europa.eu
CERT-EU Threat Intelligence CERT-EU cert.europa.eu

If you use AlertZero in more than one space, your spaces share some threat intelligence workflows, and others run separately in each space:

  • All spaces share Ingest threat feeds and Enrich threat report. Every space gets the same reports, and turning either workflow on or off affects every space. AlertZero turns them off only after Continuous Threat Hunt is off in every space.
  • Attribute alerts to reports runs separately in each space. It counts only that space's alerts, and it turns off when you turn off Continuous Threat Hunt in that space.

To build reports for Continuous Threat Hunt, the threat intelligence workflows need network access to the threat feeds and models to process reports. AlertZero also stores the reports with embeddings from your cluster's default embedding endpoint. If that endpoint isn't available, you can't turn on Continuous Threat Hunt.

Enrich threat report runs in the default space, so it uses the default space's model settings for every report, even if you hunt in another space. It makes model calls for every new report.

Workflow Requirement Effect if missing
Ingest threat feeds Outbound HTTPS access from Kibana to the domain of each supported threat feed. The workflow runs, but it collects no reports from the feeds it can't reach.
Enrich threat report Reports from Ingest threat feeds. It has nothing to process, so Continuous Threat Hunt has no reports to search for.
Enrich threat report Models for the Efficient models and Frontier models settings, configured in Feature Settings in the default space. The workflow can't process reports, so Continuous Threat Hunt has no reports to search for. The workflow retries unprocessed reports on its next run.