O cenário
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
O que há neste desenho
Entenda as decisões por trás dele.
01
Normalizing indicator types into a separate table allows consistent querying.
02
Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
03
Storing indicator-to-indicator relationships enables advanced threat hunting.
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.