## Threat Intelligence Platforms (TIPs)\n\n### What is a TIP?\n\nA **Threat Intelligence Platform** aggregates, correlates, and operationalizes threat intelligence from multiple sources.\n\n### Core Capabilities\n\n| Capability | Description |\n|------------|-------------|\n| **Aggregation** | Collect intel from multiple sources |\n| **Normalization** | Convert to standard formats (STIX) |\n| **Correlation** | Link related indicators and actors |\n| **Enrichment** | Add context (reputation, WHOIS) |\n| **Analysis** | Tools for investigation |\n| **Sharing** | Export and share with partners |\n| **Integration** | Push to SIEM, EDR, firewalls |\n\n### TIP Landscape\n\n**Open Source**:\n- MISP (Malware Information Sharing Platform)\n- OpenCTI\n- YETI\n- CRITs\n\n**Commercial**:\n- ThreatConnect\n- Recorded Future\n- Anomali ThreatStream\n- Mandiant Advantage\n- Palo Alto XSOAR\n\n### Choosing a TIP\n\n**Questions to Ask**:\n- What data sources do we need to integrate?\n- Do we need to share with external partners?\n- What integrations with our security stack?\n- Open source acceptable or need commercial support?\n- What is our budget?\n\n### Integration Architecture\n\n```\n┌─────────────────────────────────────────┐\n│           Threat Intel Platform          │\n│  ┌─────────┐  ┌─────────┐  ┌─────────┐  │\n│  │ OSINT   │  │ Feeds   │  │ Internal│  │\n│  └────┬────┘  └────┬────┘  └────┬────┘  │\n│       └───────────┬────────────┘        │\n│              ┌────┴────┐                 │\n│              │ Correlate│                │\n│              └────┬────┘                 │\n└───────────────────┼─────────────────────┘\n                    │\n     ┌──────────────┼──────────────┐\n     │              │              │\n┌────┴────┐   ┌────┴────┐   ┌────┴────┐\n│  SIEM   │   │   EDR   │   │Firewall │\n└─────────┘   └─────────┘   └─────────┘\n```