Threat Intelligence Guide
Threat intelligence is turning raw data about attackers into knowledge that changes a defender's decisions. A feed of indicators is not intelligence; intelligence is analysis that answers a specific question. The difference between the two is the difference between noise and value.
What threat intelligence actually is
Buying a feed of malicious IP addresses is not threat intelligence, it is data. Intelligence is the analysis on top: who is likely to target us, how do they operate, and what should we do about it. Intelligence answers a question a decision maker actually has.
The three levels
| Level | Audience | Answers |
|---|---|---|
| Strategic | Leadership | Who targets us and why |
| Operational | Security managers | What campaigns are active |
| Tactical | SOC and responders | What indicators and techniques to detect |
The intelligence lifecycle
- Requirements: what question are we answering
- Collection: gathering relevant data
- Analysis: turning data into assessment
- Dissemination: getting it to who needs it, in a form they can use
- Feedback: did it help, refine and repeat
Skip requirements and you collect data nobody needed. That is the most common failure.
MITRE ATT&CK, the shared language
ATT&CK is a framework of real attacker techniques. Mapping activity to it lets you describe how an adversary operates in a standard vocabulary, compare it to your detection coverage, and find the gaps. It is the backbone of modern threat intelligence and detection.
Collection sources
- OSINT, covered in OSINT tools
- Malware analysis output, from malware analysis basics
- Commercial and community feeds
- Internal telemetry, often the most relevant of all
- Dark web and forum monitoring
What makes intelligence actionable
The test: does it change a decision. Intelligence that is interesting but changes nothing is trivia. Good intelligence tells a specific audience to do a specific thing, whether that is a new detection rule for the SOC or a budget decision for leadership.
The discipline in one line: start from the question, not the data. Requirements first, collection second. Reverse that and you drown in feeds.
Practise this
Take a public threat report and map its techniques to ATT&CK, then ask what detection each one would need. That exercise is the core skill. Structured path in the threat intelligence syllabus.
Enroll in SOC
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in SOC