情境
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
這張圖裡有什麼
看懂背後的決策。
01
Normalizing indicator types into a separate table allows consistent querying.
02
Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
03
Storing indicator-to-indicator relationships enables advanced threat hunting.
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.