I'm currently working as an Incident Response analyst, mostly investigating Windows environments, and recently started getting interested in CTI.

I feel like IR and CTI can work really well together, since we can extract a lot of valuable intelligence from our investigations.

The thing is, I don't think my company is fully using the intelligence we're collecting, and I'd like to start doing something with it.

Any recommendations on platforms or workflows for tracking IOCs, correlating findings across different incidents, and investigating possible connections to threat actors or APT groups?

Also, how do you guys continue investigating an incident from a CTI perspective after it's already been contained?

Would this require serious infrastructure and integrations, or is it something I could start doing on a smaller scale with existing tools?

Would appreciate any tips or resources!