<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-identity-threat-intelligence
description: >-
  Integrate threat intelligence feeds focused on identity-based threats including compromised credentials, dark web monitoring, and attack pattern intelligence.
domain: cybersecurity
subdomain: identity-security
tags:
  - threat-intelligence
  - credential-monitoring
  - dark-web
  - identity-threats
  - proactive-defense
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Implementing Identity Threat Intelligence

## Overview

Identity threat intelligence focuses on external signals indicating identity
risks — compromised credential dumps, dark web listings, identity attack
technique evolution, and targeted campaign indicators. Integration enables
proactive credential resets and early warning of identity-focused attacks.

## Prerequisites

| Requirement | Install |
|---|---|
| Threat intelligence platform | TIP for feed aggregation |
| Dark web monitoring | Credential exposure monitoring |
| Identity provider | Azure AD, Okta, or equivalent |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Intelligence Sources

- **Credential dumps** — Breached databases (HIBP, SpyCloud)
- **Dark web monitoring** — Marketplace listings for credentials
- **Attack patterns** — New identity attack TTPs
- **Campaign indicators** — IOCs from identity-focused campaigns
- **Vulnerability intelligence** — CVEs affecting identity systems

### Integration Points

| Source | Action |
|---|---|
| Credential dump | Force password reset |
| Dark web listing | Investigate and remediate |
| New attack TTP | Update detection rules |
| Campaign IOC | Block in identity provider |
| Identity CVE | Patch or mitigate |

### Operational Workflow

1. **Collect** — Aggregate identity threat feeds
2. **Correlate** — Match against internal directory
3. **Prioritize** — Score by severity and criticality
4. **Act** — Execute response playbook
5. **Measure** — Track remediation metrics

## Workflow

1. **Inventory identity assets** — catalog all identity providers
2. **Select intelligence feeds** — choose credential and identity threat sources
3. **Configure feed integration** — connect feeds to TIP or SOAR
4. **Build correlation rules** — match intelligence against internal identities
5. **Define response playbooks** — automated actions per threat category
6. **Establish monitoring cadence** — continuous for credentials, daily for TTPs
7. **Measure effectiveness** — track exposure detection and remediation metrics

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Identity Threat Intelligence Detection
id: 46362831-5c18-4633-b6c7-a128c04b105c
status: experimental
description: Detects suspicious activity related to implementing identity threat intelligence techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

## Verification

| Check | Method |
|---|---|
| Feeds connected | All intelligence feeds active and updating |
| Correlation working | Test credential match triggers expected alert |
| Playbooks active | Response actions execute within SLA |
| Coverage measured | Percentage of identities covered |
| Metrics tracked | MTTR for identity exposures reported |

## References

- [MITRE ATT&CK — Credential Access](https://attack.mitre.org/tactics/TA0006/)
- [Have I Been Pwned API](https://haveibeenpwned.com/API/v3)
- [NIST SP 800-150](https://csrc.nist.gov/pubs/sp/800/150/final)
- [SpyCloud](https://spycloud.com/)
