What is threat intelligence?
Threat intelligence is knowledge about adversaries, their tools and techniques, and the infrastructure they use, collected and checked so that it supports a decision. The difference between data and intelligence is context. A list of 5,000 IP addresses is data. Knowing that 200 of them are command-and-control servers for a ransomware group that is breaking into companies in your sector through the VPN model you run is intelligence, because it tells you what to patch tonight and what to search your logs for.
It arrives in two broad forms. A threat feed is a continuous, machine-readable stream of indicators of compromise (IoCs), such as malicious IP addresses, domains, URLs and file hashes, that a SIEM, firewall or EDR tool can match automatically. An advisory or report is written for people and explains who is attacking, how, and what to do about it.
Where threat intelligence comes from
- Open-source intelligence (OSINT): free, public material such as researcher blogs, vendor reports, news, community blocklists and public records. Cheap and broad, but unvetted.
- Proprietary or commercial feeds: paid subscriptions from security vendors that run sensor networks, honeypots and malware labs, usually scored and tagged with context.
- Government sources: in the United States, CISA publishes advisories, often jointly with the FBI and NSA, maintains the Known Exploited Vulnerabilities catalog and runs Automated Indicator Sharing (AIS).
- Information Sharing and Analysis Centers (ISACs): sector groups such as FS-ISAC for finance and Health-ISAC for healthcare, where members share what hit them with peers facing the same attackers.
- Vendor advisories: the authoritative source on flaws and fixes in the products you own.
- Dark web monitoring: searching criminal forums, marketplaces and leak sites for your organization's credentials, data or network access offered for sale.
Your own logs, past incidents and honeypots are internal intelligence, and they are often the most relevant source of all.
Strategic, operational and tactical intelligence
| Level | Audience | Example |
|---|---|---|
| Strategic | Executives and the board | Ransomware against regional hospitals rose this year, mostly through edge devices |
| Operational | SOC leads, incident responders, threat hunters | A named group is exploiting a VPN flaw against hospitals this week |
| Tactical | SOC analysts and their tools | Hashes, domains, IP addresses and detection rules for that campaign |
Strategic intelligence stays useful for months or years. Tactical indicators can go stale within days, because attackers rotate their infrastructure.
How intelligence is shared: STIX, TAXII and TLP
Structured Threat Information Expression (STIX) is a standard language for describing threat intelligence. Version 2.1 uses JSON objects such as indicator, malware, threat actor and campaign, plus relationships that link them. Trusted Automated Exchange of Intelligence Information (TAXII) is the HTTPS-based protocol that moves STIX content between servers and clients. Both are maintained by the OASIS standards body. STIX is what is said; TAXII is how it travels.
The Traffic Light Protocol (TLP), maintained by FIRST, labels how far shared information may spread: TLP:RED for the named recipients only, TLP:AMBER within the recipient's organization and its clients on a need-to-know basis (TLP:AMBER+STRICT limits it to the organization), TLP:GREEN within the wider community but not on public channels, and TLP:CLEAR with no restriction. Many organizations collect feeds in a threat intelligence platform (TIP), such as the open-source MISP, which deduplicates and scores indicators before pushing them to security tools.
Judging the quality of a feed
More feeds do not mean better defense, since every indicator can produce an alert someone must triage. Four qualities decide whether a source earns its place:
- Timeliness: indicators arrive soon after attacks start, and stale ones are retired.
- Relevance: the intelligence fits your sector, region and technology.
- Accuracy: entries are correct. A content delivery network address on a blocklist can cut users off from many legitimate sites.
- Confidence: the producer scores how sure it is, and analysts rate their sources too.
Run a new feed in alert-only mode before letting it block traffic.
Threat intelligence on the CompTIA Security+ exam
Threat intelligence sources and feeds fall under SY0-801 objective 2.1, which covers where information about threats comes from and how it reaches people and tools. Expect scenarios that ask you to pick a source: "publicly available" or "free" points to OSINT, "paid subscription" to proprietary intelligence, sharing with peers in the same industry to an ISAC, and stolen credentials offered for sale to dark web monitoring. A question about the format of threat data points to STIX, while one about exchanging it automatically between systems points to TAXII; TLP and SCAP are the usual distractors. Delayed indicators are a timeliness problem, a feed about another industry is a relevance problem, and indicators that turn out to be benign are an accuracy problem. A board-level trend is strategic, a current campaign is operational, and indicators fed to tools are tactical.