Threat intelligence
Threat intelligence is threat information that has been analyzed and given context so it can inform security decisions, such as which attacker behaviors to investigate, detect, or test.
Give the information a job
An IP address, a malware report, and an account of a help-desk intrusion can all contribute to threat intelligence. The useful question is what each tells you about a decision you need to make.
NIST SP 800-150 covers information such as indicators, attacker tactics and techniques, and incident findings. It distinguishes collected information from intelligence produced through analysis. MITRE’s threat intelligence program guidance connects collection and analysis with actions such as updating detections and prioritizing defenses.
An indicator of compromise can help you search for a particular artifact. A description of attacker behavior can help you ask whether your environment exposes a similar opportunity. An actor name alone does neither.
Relevance and confidence matter
Check when the activity occurred, what the source actually observed, and how closely it matches your technology or business processes. A report about another company’s recovery failure is a reason to examine your recovery procedure, not proof that yours has the same weakness.
Keep uncertainty visible. If the source says activity is suspected or attribution is tentative, do not turn that into a confirmed fact when briefing colleagues. Separate the source’s findings from your own assessment of their relevance.
It Already Hit Your Sector explains how to turn external reporting into a local testing priority. The UNC3944 recovery-abuse article provides a more specific example of working from documented behavior.
Threat-informed defense is the next step: use that understanding to choose defenses and evaluate how they perform.