Threat intelligence

Threat intelligence is produced by the intelligence cycle borrowed from military and government practice: direction (defining intelligence requirements, the questions stakeholders need answered), collection, processing, analysis, dissemination and feedback. The distinction between data and intelligence lies in the analysis step: a list of malicious IP addresses is data; an assessment that a named ransomware affiliate is exploiting a particular VPN vulnerability against the organisation's sector, with detection guidance, is intelligence. Programmes without written requirements tend to become feed aggregators that generate alerts nobody can prioritise.

Output is commonly split by audience. Strategic intelligence informs leadership about actors, motives and trends; operational intelligence describes specific campaigns; tactical intelligence covers tactics, techniques and procedures (TTPs), typically mapped to MITRE ATT&CK; technical intelligence consists of indicators of compromise such as hashes, domains and IP addresses. David Bianco's Pyramid of Pain (2013) explains why the upper layers matter: hashes and IP addresses are trivial for an attacker to change, while detections built on tools and TTPs force costly changes in tradecraft. Indicators also have a short half-life, so feeds need ageing and expiry or they flood detection with false positives.

Sharing depends on common formats and handling rules. STIX 2.1 is the OASIS standard for representing threat objects and their relationships, and TAXII 2.1 is the companion protocol for exchanging them over HTTPS; MISP is a widely used open-source sharing platform. The Traffic Light Protocol, version 2.0 published by FIRST in 2022, marks how far information may be shared: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR, the last replacing the former TLP:WHITE. NIST SP 800-150 gives guidance on establishing sharing relationships, and NIS2 Art. 29 provides for voluntary cybersecurity information-sharing arrangements between entities.

ISO/IEC 27001:2022 introduced Annex A control 5.7, Threat intelligence, requiring information about threats to be collected and analysed to produce threat intelligence, which ISO/IEC 27002:2022 divides into strategic, tactical and operational layers. In a mature organisation intelligence feeds several consumers: detection engineering, vulnerability prioritisation (which CVEs are actually being exploited), incident response, and risk management, where it updates likelihood estimates. It differs from the threat landscape, which is the aggregated picture over a period; intelligence is the continuous, requirement-driven flow that keeps that picture and day-to-day defences current.