What is threat intelligence?
NIST defines it as threat information that has been aggregated, transformed, analyzed, interpreted or enriched to provide the context needed for decision-making. The last part is what matters. A list of malicious IPs is data. Knowing that those IPs belong to a ransomware campaign against companies in your sector, and what to do about it, is intelligence.
That is why it is classified by who makes the decision and over what time frame. A widely cited model distinguishes four types. It comes from a 2015 report by MWR InfoSecurity, produced with the support of the UK's CPNI and CERT-UK.
What are the 4 types of threat intelligence?
| Type | For whom | Question it answers | Examples | Shelf life |
|---|---|---|---|---|
| Strategic | Leadership, risk committee, CISO | What threats could affect the business, and where should we invest? | Ransomware trends in your sector, the risks of entering a market in another country | Months or years |
| Operational | Security lead, incident response | What specific attack is being prepared against us? | Access to your network for sale on a forum, a phishing campaign impersonating your company | Days or weeks |
| Tactical | Detection engineering, threat hunting, architecture | How do attackers operate? | A group's MITRE ATT&CK techniques, an infostealer's infection chain | Months |
| Technical | SOC and tools (SIEM, EDR, firewall) | What specific artifact should I search for or block? | IOCs: IPs, domains, URLs and hashes | Hours or days |
How is each type of intelligence used?
Strategic intelligence
It comes as reports and summaries written in business language. It helps decide budgets, prioritize projects and explain risks to the executive committee. Its typical flaw is staying at the level of global trends with no connection to your sector, your size or your technology.
Operational intelligence
It is the hardest to obtain, because it requires monitoring where attacks are prepared (forums, marketplaces and messaging channels) and cross-referencing that with what belongs to you: domains, brands, executives and suppliers. Its value is early warning. A credential for sale today may be next week's initial access.
Tactical intelligence
It describes attackers' tactics, techniques and procedures, usually in the language of MITRE ATT&CK. It lasts longer than indicators, because it is harder for an attacker to change how they work than to change their infrastructure. It feeds detection rules, threat hunting hypotheses and architecture decisions.
Technical intelligence
These are indicators of compromise designed for machines: IPs, domains, URLs and hashes that are loaded into the SIEM, EDR or firewall. It is the easiest type to automate and the first to go stale. Without a date, context and confidence level, it generates more false positives than detections.
What is the threat intelligence lifecycle?
It is the process that turns raw data into useful intelligence. The classic version has six phases. Google, for example, describes five and does not treat dissemination as a separate phase.
- Planning and direction: define what you need to know through specific questions, called intelligence requirements. For example: "Which ransomware groups target logistics companies in Europe, and how do they get in?"
- Collection: gather data from the sources that can answer those questions.
- Processing: normalize, deduplicate, translate and structure the information, for example in STIX format.
- Analysis and production: draw conclusions, assess relevance to your organization and propose actions.
- Dissemination: deliver each product to its audience in the format it needs. Indicators go to the tools, TTPs to the detection team and summaries to leadership.
- Feedback: check whether the intelligence was useful and adjust the requirements for the next cycle.
If you skip the first phase, the program piles up feeds and nobody knows which question they answer.
Where does threat intelligence come from?
| Source | What it provides | Limitations |
|---|---|---|
| OSINT (open sources) | Vendor reports, advisories from CISA and Spain's INCIBE-CERT, researchers, domain and certificate records | Lots of noise and duplicates; requires filtering and cross-checking |
| Sharing communities | Indicators and analysis shared by companies in the same sector, often through platforms such as MISP | Uneven quality; reciprocity is expected |
| Dark web, forums and messaging apps | Leaked credentials, access for sale and mentions of your company | Difficult and risky to access; requires specialists and isolated environments |
| Your own telemetry | What has already happened in your systems: alerts, incidents and hunting findings | You only see what you log |
| Commercial providers | Tracking of threat actors and campaigns, curated data that can be integrated with your tools | Cost and overlap between providers |
What makes threat intelligence useful for a company?
- Relevance: it covers your sector, your technology, your geography and your suppliers.
- Timeliness: it arrives before the data loses value. An IOC from six months ago is rarely useful for blocking.
- Actionability: it leads to a specific decision, such as blocking, hunting, patching or alerting someone.
- Context and confidence: it states the source, date and confidence level, so you can decide whether to apply it automatically or send it for review.
- Integration: it reaches your tools (SIEM, EDR, firewall, ticketing) automatically instead of sitting in a PDF.
- Measurement: you can count which detections, blocks or decisions it has led to.
A common red flag: millions of indicators loaded with no expiration date, and not a single detection that can be attributed to them.
How Ciberia Intel helps
Ciberia Intel brings together our own and third-party threat intelligence on threat actors, campaigns, malware families, vulnerabilities, IOCs and reports, as well as credentials stolen by infostealers and activity on the dark web and forums, and cross-references it with what is happening in your organization. It is processed by proprietary AI, built on our own architecture, on servers located in Spain. That intelligence gives context to Ciberia MDR alerts, prioritizes Threat Hunting campaigns and backs up Ciberia CTM exposure alerts.
