Threat intelligence
noun · also CTI, Cyber threat intelligence · NIST SP 800-150
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.
Raw data about threats, such as a list of malicious IP addresses, becomes intelligence only when someone puts it in context: who is behind it, what they want, how they operate and what it means for your organization. Threat intelligence is usually described at three levels:
- Strategic: trends and risks for decision makers, such as which groups target your industry and why.
- Operational: details about specific campaigns, including timing, targets and the tools being used.
- Tactical: technical details defenders can act on directly, such as indicators of compromise and attacker techniques.
NIST's guide to cyber threat information sharing covers how organizations can exchange this information safely, and standards such as STIX and TAXII define common formats for it.
Example
A government advisory warns that a ransomware group is exploiting a specific VPN vulnerability and lists the IP addresses and file hashes it uses. Your team checks whether you run that VPN, patches it, searches the logs for the listed indicators and adds a detection for the group's typical post-exploitation behavior.
Why it matters for a SOC analyst
Intelligence tells you what to look for and how worried to be. An alert involving an IP address linked to an active ransomware group deserves faster escalation than one involving a generic scanner. Learn to read advisories critically: indicators expire quickly, while the techniques an attacker uses change much more slowly and make better detections.
Related terms
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- Tactics, techniques and procedures
How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).
- Advanced persistent threat
A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.
- Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.
- MITRE ATT&CK
A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.