Intel on Adversaries

An Adversary is any individual or a group that attempts harmful activities like cyber-attack or spying to threaten cyber resources.
The Adversaries tab gives information about the detected adversaries. Adversary details include adversary names, type, target country, target industry, first seen and last seen. These adversary details help to detect, analyse and respond to cyber threats effectively.
This intel offers a comprehensive view of threat actors, including their tactics, techniques, and associations. It helps in understanding attacker motives, targeted regions and targeted sectors. Organizations can use this intelligence to anticipate attacks and enhance threat-hunting capabilities.

Viewing the Adversary Details

You can view the adversary details such as adversary name, type, target country, target industry, first and last seen in the tabular format. To view the details of each adversary, follow these steps:

1. On the Seqrite Threat Intelligence portal, click Adversaries in the left pane.
2. On the Adversaries page, select the adversary and click the > icon.
   The adversary details page displays the following details:
• Adversary Overview: Adversary Name, Target Country, Target City, Target Sector, Attack Origination, Goals, Motivations, First Seen and Last Seen.
• TTP Mappings: Links to tactics, techniques, and procedures associated with the adversary.
• Associations: Known relations with Threats Actors, Malware or IoCs.

Selecting Column from the Column Selector

The Column Selector allows you to customize the table view. You can choose the desired column to display on a table.

• To choose columns, click on the Adversaries page and select the desired column.

Note: You can choose up to 7 columns to display.

Filtering the Adversary List

You can filter the adversary list to refine results based on types.
To filter the adversary list, follow these steps:

1. On the Seqrite Threat Intelligence portal, click Adversaries in the left pane.
2. On the Adversaries page click .
3. Enter the attribute that is adversary name, type, first seen date, or the last seen date, and click Apply.

The system displays filtered data.

Exporting Adversaries as a CSV/STIX

You can download all adversaries currently visible on the page in the CSV or STIX format.
To export/download the adversaries, follow these steps:

1. On the Seqrite Threat Intelligence portal, click Adversaries in the left pane.
2. On the Adversaries page click Export, select the format that is CSV or STIX 2.1, and then click Export.

Viewing Adversary Export History

Export History shows a record of all the adversaries that have been exported by the user.
Export History provides a record that is export name, format (STIX or CSV), file size, created date, and status.

• To view the export history, click Export History on the Adversaries page.
  The list of exported adversaries is displayed.