Efficient Packet Capture for Cyber Threat Analysis

A method comprising:

• receiving, by a computing device, a plurality of packets, wherein the computing device comprises a boundary device between a protected network and an unprotected network;
• capturing, by the computing device, on a packet-by-packet basis, at least one packet received by the computing device based on at least one of one or more packet filtering rules;
• and
• generating, by the computing device, a packet capture file comprising raw packet content and threat context information, wherein the threat context information comprises at least one filtering rule that caused a packet to be captured and at least one threat indicator that caused the packet to be captured, wherein the at least one filtering rule and the at least one threat indicator are associated.

An apparatus comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, causes the apparatus to:
• receive, by the apparatus, a plurality of threat indicators from one or more threat intelligence providers, wherein the apparatus comprises a boundary device between a protected network and an unprotected network;
• in response to receiving the plurality of threat indicators, combine at least two of the plurality of threat indicators based on a source address, a source port, a destination address, a destination port, and a protocol type associated with each of the plurality of threat indicators;
• generate one or more packet filtering rules based on the combined threat indicators;
• and
• filter, by the apparatus, on a packet-by-packet basis, at least one packet received by the apparatus based on at least one of the one or more packet filtering rules.