Le scénario
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
Ce que contient ce dessin
Comprenez les décisions qui le sous-tendent.
01
Normalizing indicator types into a separate table allows consistent querying.
02
Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
03
Storing indicator-to-indicator relationships enables advanced threat hunting.
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.