What Is Threat Intelligence

Threat intelligence refers to insights derived from collecting and analyzing information about cyber threats and processing it into a form that supports organizational decision-making. It is not merely an accumulation of threat data, but actionable information with context that answers "what threatens our organization and how should we respond."

One way to organize threat intelligence is to divide it into three levels. Strategic intelligence is for executives, presenting the overall threat landscape and risk trends. Tactical intelligence is for security managers, analyzing attacker TTPs (Tactics, Techniques, and Procedures). Operational intelligence is for SOC operators, providing specific detection indicators as IoCs (Indicators of Compromise) such as IP addresses, domains, and file hashes.

By leveraging threat intelligence as part of incident response preparation, you can strengthen your defenses before an attack occurs.

Collection Sources and Analysis Frameworks

Main sources of threat intelligence include open-source information (OSINT), commercial feeds, industry-shared information, and internal data.

OSINT (Open Source Intelligence): Publicly available sources such as CVE databases, security vendor blogs, malware analysis reports, and threat information on social media. Free to use, but reliability assessment is required.

Commercial Threat Intelligence Feeds: Paid threat information services provided by security vendors. These include automated IoC delivery, attacker profiles, and industry-specific threat reports.

Industry-Shared Information: Threat information shared with peers through ISACs (Information Sharing and Analysis Centers) and CSIRT communities. OASIS has standardized STIX, a language and serialization format for threat intelligence, and TAXII, a protocol for exchanging it over HTTPS, and both can be used for automated sharing.

One analysis framework is MITRE ATT&CK. ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations, and can be used for gap analysis of your organization's defensive coverage and for designing SIEM detection rules.

Practical Application of Threat Intelligence

Here are practical approaches to ensure threat intelligence is not just collected but actually applied to your organization's defenses.

Automated IoC Application: Automatically apply malicious IP addresses, domains, and file hashes obtained from threat intelligence feeds to firewalls, IDS/IPS, and SIEM. STIX and TAXII help automate the process from collection to application.

Threat Hunting: Beyond known IoCs, proactively search for undetected threats in your organization's logs and network traffic based on ATT&CK TTPs. Leverage SIEM query capabilities and EDR hunting features.

Integration with Vulnerability Management: Use threat intelligence to identify vulnerabilities that are actively being exploited, and apply this to prioritize patching. By considering actual exploitation status (Exploit in the Wild) in addition to CVSS scores, you can focus limited resources on higher-risk vulnerabilities.

Executive Reporting: As strategic intelligence, regularly report to executives on trends of attack groups targeting your industry, attack technique trends, and changes in risk.

Building a Threat Intelligence Program

A phased approach for introducing a threat intelligence program into your organization.

Phase 1: Requirements Definition - Define what constitutes a threat to your organization and what information is needed. Identify threats to prioritize monitoring based on your industry, assets, and past incident history.

Phase 2: Build Collection Infrastructure - Set up information collection channels including OSINT tools, commercial feeds, and industry ISAC membership. Deploy a TIP (Threat Intelligence Platform) to centrally manage information from multiple sources.

Phase 3: Analysis and Distribution - Analyze collected information and extract threats relevant to your organization. Distribute analysis results in formats appropriate for each audience, such as SOC, CSIRT, and executives.

Phase 4: Feedback and Improvement - Evaluate how intelligence has contributed to actual defense and continuously improve collection and analysis processes. Regularly review information sources and analysis methods to address emerging threats such as zero-day attacks.

To learn more about this topic, see Supply Chain Attacks: The New Threat Exploiting Trust.

Common Misconceptions

Threat intelligence is just a list of IoCs (IP addresses and hash values): IoCs are only one part of threat intelligence. True threat intelligence is contextual insight that analyzes attacker motivations, capabilities, and TTPs, and indicates specific risks and countermeasures for your organization. IoCs alone can lose their value once an attacker changes their methods.
You need an expensive commercial service to use threat intelligence: Useful threat intelligence can be built from OSINT alone (CVE databases, security vendor blogs, MITRE ATT&CK, LevelBlue OTX (formerly AlienVault OTX), etc.). Commercial services excel in information coverage and automation, but starting with free sources and gradually expanding is a realistic approach.

Threat Intelligence