What is Threat Intelligence?

by Chris Brook on Tuesday July 21, 2020

Threat intelligence is what becomes of data after it has been gathered, processed, and analyzed. Organizations can use threat intelligence against cyber threats. In this article, we’ll discuss what threat intelligence is, its types, how it works, and why it’s important.

Definition of Threat Intelligence

Threat intelligence or cyber threat intelligence is information organizations can use against cyber threats. It’s not the same as raw data, which has to be analyzed first for gaining actionable insights. Thus, threat intelligence is what becomes of raw data after it has been collected, processed, and analyzed so it can be used for making informed decisions. It is accurate, actionable, relevant, and timely.

Why is Threat Intelligence Important?

With so many cyber threats out there, threat intelligence can help organizations gain the information they need to identify and protect themselves against cyber threats. For instance, if organizations could learn the patterns of hackers or cyber attackers, they could put in place effective defenses and mitigate any risks that could impact their businesses. Threat intelligence also helps companies avoid data breaches. They can also share intelligence with other companies, which helps the industry to collectively prevent future threats.

While threat intelligence looks like the domain of advanced analysts, in reality, everyone who has a stake in security can benefit from it. Anyone involved with security operations, vulnerability management, fraud prevention, and risk analysis can use threat intelligence to drive decision-making.

The Threat Intelligence Lifecycle

Instead of an end-to-end process, threat intelligence works in a circular process called the threat intelligence lifecycle. It’s a cycle because new questions and knowledge gaps could come up during the process which may generate new collection requirements.

The cyber threat intelligence cycle is made up of several phases:

Planning and direction: Requirements for data collection are defined first. We should ask the right questions that will generate actionable information.
Collection: After defining the collection requirements, raw pieces of data about current or future threats are gathered. Various threat intelligence sources can be used, like internal logs and records as well as the Internet and other technical sources.
Processing:The collected data is then organized with metadata tags. Redundant information, false positives, and false negatives are filtered out. Solutions (like SIEM or SOAPA) will be a handy tool here, making it easy to organize collected data.
Analysis: This phase is what differentiates threat intelligence from simple information gathering and dissemination. Here, processed data is analyzed with structured analytical techniques. This will produce cyber threat intelligence feeds that help analysts look for indicators of compromise (IOC). Common IOCs include suspicious links or websites, emails and email attachments, and registry keys.
Dissemination:The product of analysis is then sent to the right persons in a timely manner. Dissemination is tracked so that there’s continuity from one cycle to the next.
Feedback:The person/s who made the request review the threat intelligence and determine if the intelligence adequately addressed their questions. If yes, the cycle comes to a close. In a case in which there is a new requirement, the process goes back to the starting phase.

Blog Post

Threat Intelligence Tips: Monitoring, Alerts, Automation & More

READ NOW

Types of Threat Intelligence

The intelligence product looks different depending on the initial requirements, the threat intelligence sources, and the intended audience of the intelligence. So based on these criteria, there are three types of threat intelligence:

Strategic threat intelligence: This covers broad trends or long-term issues usually intended for a non-technical audience. Strategic threat intelligence can generate a big picture of the intent and the capabilities of cyber threats. This helps in making informed decisions or providing prompt warnings.
Tactical threat intelligence: This supports day-to-day operations and events, like working on IOCs. Tactical threat intelligence provides a structure of TTP (tactics, techniques, and procedures of threat actors) for a more technical audience.
Operational threat intelligence: This intelligence is highly specialized and technical. It is often related to specific attacks, campaigns, malware, or tools. Operational threat intelligence may be in the form of a forensic cyber threat intelligence report.

What to Look for in a Threat Intelligence Program

The value of threat intelligence is undeniable. It has become a necessity for organizations of all shapes and sizes. A cyber threat intelligence platform automates the data collection and analysis process, enabling analysts to identify, investigate, and respond to threats promptly. Here are some questions for your guidance when looking for a threat intelligence platform: