Introduction to Threat Intelligence
This domain tests definitional precision: can you separate data from intelligence, place a product at the right level, and explain how requirements - not feeds - drive a programme. Expect short scenario items asking which type of intelligence a named stakeholder actually needs.
Data, information, intelligence, decision
- Data: raw, uncontextualised observations - a log line, an IP address, a file hash.
- Information: data plus context - "198.51.100.7 beaconed to a known C2 port at 03:00".
- Intelligence: information that has been analysed, validated and framed against a requirement so it can change a decision - "your sector is being targeted through that infrastructure; prioritise the exposed appliance this week".
Apply the test: does it answer a known requirement and reduce uncertainty for a named consumer? If not, it is data or information.
Levels of intelligence
- Strategic - board and CISO, months to years; adversary intent, sector targeting, geopolitical risk; informs budget and risk appetite.
- Operational - security managers, weeks to months; campaigns and intrusion sets; informs resourcing and hunt priorities.
- Tactical - SOC, hours to days; indicators and technique-level detection content; informs blocking and alerting.
Threat, risk, vulnerability
Threat is an actor with intent, capability and opportunity. Vulnerability is a weakness. Risk is likelihood × impact, weighted by asset value. Intelligence feeds the threat and likelihood side; it does not replace vulnerability management or asset inventory.
Producers, consumers, requirements
Intelligence exists to support a decision. Consumers state Priority Intelligence Requirements; producers collect and analyse against them and report back. A feed with no requirement behind it is a compliance exercise.
Worked example
The CISO asks: "Should we accelerate the EDR rollout into the OT segment?" The analyst holds a vendor report naming a ransomware affiliate that hit three regional manufacturers through unmanaged OT hosts. Reasoning: the consumer is the CISO (strategic), the horizon is two quarters, so the deliverable is a judgement on likelihood and impact with confidence stated - not a hash list. The same report given to the SOC would instead produce detection content. Right data, wrong framing, and the decision goes unsupported.
Traps that cost marks
- Calling an indicator feed "threat intelligence" - it is data at best.
- Treating attribution as the goal; consumers usually need prioritisation, not names.
- Confusing threat with risk, or intelligence with vulnerability scan output.
- Judging feeds by volume rather than relevance to requirements.