El escenario
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
Qué hay en este dibujo
Lee las decisiones que hay detrás.
01
Normalizing indicator types into a separate table allows consistent querying.
02
Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
03
Storing indicator-to-indicator relationships enables advanced threat hunting.
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.