I85PREP
⌘ K
CTI study materials
CTI study resources

CTI: Threat Intelligence Types and Sources

CTI · Work through your exam, one topic at a time.

All guide sections

Threat Intelligence Types and Sources

This domain tests source selection and source evaluation: which discipline answers which question, how reliable a source is, and how corroboration affects the confidence you may state.

Source disciplines

  • OSINT - vendor blogs, CERT advisories, news, social media, code repositories, certificate transparency, scanning data.
  • HUMINT - human sources: ISAC peers, incident responders, insiders, covert contacts.
  • SIGINT/COMINT - intercepted communications; almost always government-held.
  • TECHINT - captured malware, forensic artefacts, infrastructure scanning, sandbox output.
  • IMINT/GEOINT, MASINT - imagery, geospatial and measurement signatures.
  • Internal telemetry - EDR, DNS, proxy, identity logs, honeypots. Highest relevance to you, often least exploited.

Feed categories and selection criteria

Commercial (SLA-backed, curated), open/free (variable quality, high volume), community/ISAC/CERT, dark-web and paste monitoring, malware research, government advisories. Evaluate each on coverage of your sectors and regions, latency, false positive rate, machine-readability and API support, licensing and redistribution rights, and provenance.

Admiralty ratings

Source reliability A–F: A completely reliable, B usually reliable, C fairly reliable, D not usually reliable, E unreliable, F cannot be judged. Information credibility 1–6: 1 confirmed, 2 probably true, 3 possibly true, 4 doubtful, 5 improbable, 6 cannot be judged. Combine as "B2". Independence is decisive: a dozen outlets citing one vendor blog is one source, not twelve.

Worked example

A vendor blog announces a new loader "in the wild"; internal telemetry shows the same loader's hash executing twice last week. The blog is B2 - a single commercial source, unconfirmed by a second party. The internal telemetry is A1 for the fact that it executed, but says nothing about campaign intent or scope. Reasoning: internal evidence is more credible on the factual question, the external source supplies context, and neither alone supports a strategic judgement. The product states both, rates each separately, and gives moderate confidence.

Traps that cost marks

  • Counting syndicated copies as corroboration.
  • Assuming free means bad and commercial means good; check currency and regional coverage.
  • Treating a sandbox verdict as finished analysis.
  • Ignoring internal telemetry because it does not look like "intelligence".