A tool for data visualization and statistical analysis of threat intelligence indicator feeds to measure their quality and effectiveness.
tiq-test is a tool for data visualization and statistical analysis of threat intelligence indicator feeds. It helps security professionals measure the quality and effectiveness of their threat intelligence sources by analyzing characteristics like aging, uniqueness, and overlap between feeds. The project provides quantitative metrics to assess what it calls the "Threat Intelligence Quotient" of different feeds.
Security analysts, threat intelligence teams, and cybersecurity professionals who need to evaluate and compare different threat intelligence feeds. It's particularly useful for organizations managing multiple intelligence sources.
Provides a data-driven approach to threat intelligence evaluation using statistical methods, helping teams make informed decisions about which feeds provide the most value. Unlike manual assessment, it offers reproducible, quantitative metrics for comparing intelligence sources.
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides quantitative metrics like aging and uniqueness tests to objectively assess threat intelligence feeds, as demonstrated in presentations at DEF CON and SANS CTI Summit.
Uses R's ggplot2 to create detailed, publication-quality visualizations for easier interpretation of TI feed data, with examples available in RPubs files.
Developed by the MLSec Project and presented at major security conferences, lending credibility and a focus on data science methodologies in cybersecurity.
Released under GPLv3 with source code and data repositories available, allowing for customization and reproducible threat intelligence assessments.
Not packaged as a standard R library, requiring manual source loading and directory setting, which complicates usage and integration compared to typical R packages.
Last updates and presentations were from 2014-2015, with no recent activity, potentially lacking support for modern R versions or current threat intelligence formats.
Requires installation of R, RStudio, and multiple specific packages, with setup steps that assume familiarity with R console commands and environment management.