The levels of threat intelligence

  • Strategic: trends and risks for leadership, such as which sectors ransomware groups are targeting.
  • Operational: details of specific campaigns and actors, such as how a group gets initial access.
  • Tactical: attacker techniques, often mapped to MITRE ATT&CK, used to improve defences.
  • Technical: indicators of compromise such as IP addresses, domains and file hashes for blocking and detection.

The intelligence lifecycle

  1. Direction: decide what questions the intelligence must answer.
  2. Collection: gather data from open, closed and internal sources.
  3. Processing and analysis: filter, correlate and assess reliability.
  4. Dissemination: deliver it to the people who act on it, in a form they can use.
  5. Feedback: refine the questions based on what proved useful.

Why context matters

Raw feeds of indicators produce noise. Intelligence becomes useful when it is matched to your own environment: an exploited vulnerability matters most if you run that software on an internet-facing system, and a ransomware group matters most if it targets your sector and region. Combining external threat intelligence with knowledge of your own attack surface is what turns information into decisions.

How DarkInvader helps

DarkInvader's Global Threat Intelligence matches exploited vulnerabilities, malware, threat group activity and intelligence to your industry, locations and technologies, so it reflects the threats that actually apply to your attack surface.

Explore Global Threat Intel

Frequently asked questions

What is the difference between threat intelligence and threat data?

Threat data is raw information, such as a list of malicious IP addresses. Threat intelligence is that data after analysis and context have been added, so it answers a question and supports a decision.

Who uses threat intelligence?

Security operations teams use it for detection, vulnerability teams for prioritisation, incident responders for investigation, and leadership for understanding strategic risk.

Is open-source threat intelligence enough?

It is a good start and much of it is high quality, such as government advisories. Commercial and closed sources add earlier warning, dark web visibility and analysis tailored to your organisation.

Related terms and reading

Sources