Threat Intelligence: Sources, Standards, and Judgement
The intelligence lifecycle and source tiers
Threat intelligence questions test whether you can pick the right source and the right level of confidence. Know the lifecycle: direction (requirements), collection, processing, analysis, dissemination, feedback. Distinguish strategic (board-level trends), operational (campaigns and actor intent), and tactical/technical (IOCs such as hashes, domains, IPs). Sources range from OSINT (public, free, variable quality) through commercial feeds to ISACs and closed sharing communities. Prefer primary reporting over aggregators that strip context.
Standards and frameworks
Be fluent with STIX/TAXII (STIX is the structured data model; TAXII is the transport), MISP for sharing, and the Cyber Kill Chain versus MITRE ATT&CK (ATT&CK is behavior-based tactics/techniques, not a linear sequence). Understand the diamond model (adversary, capability, infrastructure, victim). Know the traffic light protocol (TLP) levels and that TLP:RED must not be shared outside the named recipients.
Traps and a rule of thumb
Traps: assuming an IOC match means compromise (shared hosting and CDNs produce false positives); confusing STIX with TAXII; treating an ATT&CK technique ID as an IOC; and ignoring confidence versus impact. Also know IOC decay: IP and domain indicators age fast, file hashes age slower, TTPs age slowest.
Worked example: a feed reports an IP as C2. Before blocking, check how many of your hosts contacted it, whether it resolves to a shared cloud range, and when the report was published. If the IP is a CDN edge shared by thousands of sites, downgrade to monitoring and hunt for the associated TTP instead. Rule of thumb: intelligence is only useful when paired with context (who, when, confidence) and an action (block, detect, hunt, ignore).