The scenario
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
What is in this drawing
Read the decisions behind it.
01
Normalizing indicator types into a separate table allows consistent querying.
02
Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
03
Storing indicator-to-indicator relationships enables advanced threat hunting.
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.
More like this