Threat intelligence

Also known as: cyber threat intelligence, CTI

Up-to-date knowledge about current attackers and their methods, gathered so attacks can be stopped before they land.

Draft - this entry has not been reviewed yet.

How to put it into practice

The usual steps, in order. Adapt them to your organisation.

Write down your intelligence requirements - the questions management, the SOC, vulnerability management and risk owners need answered, such as which groups target your sector and which vulnerabilities they exploit.
Choose sources that answer those questions, such as national threat assessments and warnings, sector sharing groups, vendor reports and a small number of feeds, and avoid depending on a single provider.
Join at least one sharing community for your sector, and agree how you handle shared information using the Traffic Light Protocol.
Name an owner who reads, assesses and filters incoming intelligence, and give analysts time for written reports, not just indicator feeds.
Deliver it in the form each reader needs - short strategic briefings for management, TTPs mapped to MITRE ATT&CK for detection and hunting, and exploited vulnerabilities for patch prioritisation.
Load indicators into the SIEM, EDR and blocking tools with a confidence score and an expiry date, so old indicators age out instead of causing false positives.
Ask the readers every quarter whether the intelligence helped them act, and adjust the requirements and sources accordingly.

Common pitfalls

Buying many feeds without written requirements, so the SOC drowns in indicators nobody can prioritise.
Keeping indicators forever, although attackers can change IP addresses and domains with little effort.
Sharing information further than its TLP label allows, which damages trust in the sharing community.

Good guides

NIST SP 800-150 - Guide to Cyber Threat Information Sharing(opens in a new tab) · NIST
Building a Security Operations Centre (SOC) - Threat Intelligence(opens in a new tab) · NCSC UK
Traffic Light Protocol (TLP) 2.0(opens in a new tab) · FIRST
Trusselsvurderinger - Cyber(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)

Technical deep dive

Threat intelligence is produced by the intelligence cycle borrowed from military and government practice: direction (defining intelligence requirements, the questions stakeholders need answered), collection, processing, analysis, dissemination and feedback. The distinction between data and intelligence lies in the analysis step: a list of malicious IP addresses is data; an assessment that a named ransomware affiliate is exploiting a particular VPN vulnerability against the organisation's sector, with detection guidance, is intelligence. Programmes without written requirements tend to become feed aggregators that generate alerts nobody can prioritise.

Output is commonly split by audience. Strategic intelligence informs leadership about actors, motives and trends; operational intelligence describes specific campaigns; tactical intelligence covers tactics, techniques and procedures (TTPs), typically mapped to MITRE ATT&CK; technical intelligence consists of indicators of compromise such as hashes, domains and IP addresses. David Bianco's Pyramid of Pain (2013) explains why the upper layers matter: hashes and IP addresses are trivial for an attacker to change, while detections built on tools and TTPs force costly changes in tradecraft. Indicators also have a short half-life, so feeds need ageing and expiry or they flood detection with false positives.

Sharing depends on common formats and handling rules. STIX 2.1 is the OASIS standard for representing threat objects and their relationships, and TAXII 2.1 is the companion protocol for exchanging them over HTTPS; MISP is a widely used open-source sharing platform. The Traffic Light Protocol, version 2.0 published by FIRST in 2022, marks how far information may be shared: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR, the last replacing the former TLP:WHITE. NIST SP 800-150 gives guidance on establishing sharing relationships, and NIS2 Art. 29 provides for voluntary cybersecurity information-sharing arrangements between entities.

ISO/IEC 27001:2022 introduced Annex A control 5.7, Threat intelligence, requiring information about threats to be collected and analysed to produce threat intelligence, which ISO/IEC 27002:2022 divides into strategic, tactical and operational layers. In a mature organisation intelligence feeds several consumers: detection engineering, vulnerability prioritisation (which CVEs are actually being exploited), incident response, and risk management, where it updates likelihood estimates. It differs from the threat landscape, which is the aggregated picture over a period; intelligence is the continuous, requirement-driven flow that keeps that picture and day-to-day defences current.

What to learn first

Everything this builds on, foundations first.

Threat
→Threat intelligence

Relationships

Consists of: Indicator of compromise (IoC)
Requires: Threat
Mitigates: Phishing
Used with: Threat landscape CVE and CVSS MITRE ATT&CK Risk management Risk monitoring SIEM Security operations centre (SOC)Threat hunting

Sources & further reading

Standards & official texts

NIST SP 800-150

Course material

Cyber Security Fast Track - Ordliste

Where this data comes from

This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.

See the review queue Suggest a correction on GitHub This term as JSON

Mentioned in

SOAR

Check yourself

Loading…