What is Threat Intelligence?

Raw threat data, a list of malicious IPs, a malware sample hash, a leaked credential dump, becomes intelligence only after analysis adds context: who is behind it, what they're after, and how confident the assessment is. Intelligence splits into four tiers. Strategic intelligence serves executives with trend-level findings, for example that ransomware affiliates are increasingly targeting healthcare supply chains. Operational intelligence tracks specific ongoing or planned campaigns against a sector or region. Tactical intelligence documents the TTPs a named actor uses: which tools, which initial access methods, which persistence mechanisms. Technical intelligence is the IOC layer: hashes, IPs, domains, and file names that detection systems consume directly.

Analysts rate confidence using structures like the Admiralty System (source reliability A through F, information credibility 1 through 6), because acting on a low-confidence IOC without context wastes investigative time. The Pyramid of Pain ranks indicator types by how much it costs an adversary to change them: IP addresses and hashes are trivial to rotate, while TTPs are expensive to abandon, which is why tactical intelligence has more lasting detection value than a raw IOC feed.

Sources span commercial platforms (Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence), open-source feeds (MISP communities, AlienVault OTX, abuse.ch), government advisories (CISA, FBI Flash/PIN alerts, NCSC), and an organization's own incident history. Threat Intelligence Platforms (TIPs) ingest these via STIX/TAXII, deduplicate, and let analysts pivot from an indicator to the campaign and actor it belongs to.

Intelligence-driven security shifts a SOC from reactive alerting to proactive hunting: instead of waiting for a signature to fire, analysts search for the specific TTPs a threat actor targeting their industry is known to use, before those techniques trigger any alert at all.

The intelligence cycle formalizes how raw data becomes a finished product: direction (defining what questions the organization needs answered, such as which ransomware groups target this industry), collection (pulling from feeds, sensors, and open sources), processing (normalizing formats, deduplicating, filtering noise), analysis (connecting data points into an assessment with a stated confidence level), dissemination (getting the finished report to the people who need to act on it, whether that's a SOC analyst or the board), and feedback (checking whether the intelligence actually answered the original question). Skipping straight from collection to dissemination, without analysis, is how organizations end up with IOC feeds nobody trusts enough to act on.