At 8:05 on a Tuesday, a SOC analyst's queue holds three new items: a joint advisory from CISA and the FBI about a VPN appliance flaw that a state-backed group is exploiting, a bulletin from the appliance vendor listing fixed firmware versions, and 4,200 fresh IP addresses from the company's paid threat feed. All three are threat intelligence. Each came from a different kind of source and supports a different decision, and an analyst who treats them the same way will either miss the urgent one or drown in the noisy one.
On the CompTIA Security+ SY0-801 exam, intelligence sources and threat feeds sit under objective 2.1, which expects you to know where information about threats comes from and how it reaches the people and tools that use it. This lesson covers the main source types, the three levels of intelligence, the STIX and TAXII standards, and the qualities that make a feed worth trusting.
Threat intelligence is information someone can act on
Threat intelligence is knowledge about adversaries, their methods and their infrastructure that has been collected, checked and put in context so it supports a decision. A list of 4,200 IP addresses is data. Knowing that 300 of them are command-and-control servers for a ransomware affiliate is information. Knowing that the affiliate is breaking into companies in your sector through the VPN model you run, so you should patch tonight and search your VPN logs for those 300 addresses, is intelligence.
Intelligence earns its cost by changing what defenders do: which patch goes first, what the SIEM alerts on, what a threat hunter looks for, how a CISO argues for next year's budget. A report that changes none of those decisions was interesting reading, not intelligence.
It arrives in two forms. A threat feed is a continuous, usually machine-readable stream, most often of indicators of compromise (IoCs) such as malicious IP addresses, domains, URLs and file hashes that tools match against traffic and logs. An advisory or report is written for people and explains a threat, how it operates and what to do about it. The indicator types themselves are taught in the malware and indicators section; this lesson is about where they come from.
Open-source and commercial feeds trade cost against curation
Open-source intelligence (OSINT) is drawn from publicly available material: researchers' blogs and conference talks, vendors' published threat reports, news, researchers' social media posts, public code repositories where proof-of-concept exploits appear, and free community feeds listing malicious URLs, malware samples and botnet servers. Public records count too. Analysts pivot from one malicious domain to related ones through WHOIS registration details, passive DNS history and certificate transparency logs.
OSINT's strengths are cost and breadth; its weakness is that nobody vetted it for you. Free feeds vary widely in quality, and some include addresses that belong to shared hosting or content delivery networks, where blocking one IP can cut users off from hundreds of legitimate sites. Attackers use OSINT too, mining the same public sources, from job postings to DNS records, when they plan reconnaissance against you.
Proprietary or commercial intelligence is sold by security companies, usually as a subscription. These vendors run sensor networks, honeypots, malware labs and incident response teams, so their feeds tend to be deduplicated, scored and tagged with context such as the malware family behind each indicator. Many products include one whether or not anyone bought it separately: a next-generation firewall's URL reputation service and an EDR agent's cloud lookups are both commercial intelligence. The trade-offs are cost and opacity, because vendors rarely disclose exactly how they collected what they sell.
On the exam, "publicly available," "free" or "news, forums and social media" points to OSINT, while "paid subscription" or "third-party vendor feed" points to proprietary intelligence.