Threat Intelligence Fundamentals
This domain tests whether you can separate raw data from finished intelligence, place an activity at the right intelligence level, and defend a judgement with a stated confidence. Expect scenario questions - scraping a paste site, briefing a CISO, writing a YARA rule - that ask which level or lifecycle phase is involved.
Data, information, intelligence
Data is an unprocessed observation (a log line, an IP). Information is data with context (that IP resolves to a bulletproof hoster). Intelligence is information that has been evaluated, analysed, and tied to a requirement so it can support a decision. If a product does not change or confirm a decision, it is reporting, not intelligence.
The lifecycle
Direction (requirements) → Collection → Processing → Analysis → Dissemination → Feedback. Direction is the phase most often skipped and most often tested: without a Priority Intelligence Requirement (PIR) there is no basis for collection and no standard for relevance.
Levels of intelligence
- Strategic: long horizon, executive audience; actors, campaigns, sector risk, geopolitical drivers.
- Operational: campaigns and actor intent affecting near-term operations.
- Tactical: adversary behaviours (TTPs) mapped to MITRE ATT&CK.
- Technical: atomic artefacts - hashes, domains, IPs, YARA rules.
Pyramid of Pain
Hashes and IPs are trivial for an adversary to change; TTPs are costly. Detection value rises as you move up: hash → IP → domain → host/network artefact → tool → TTP.
Worked example
A feed reports 40 domains serving a loader. The PIR asks: which actors target our finance sector, and how would they establish initial access? Direction sets the PIR; collection pulls the feed plus sandbox reports; processing deduplicates and enriches with registration dates and TLS certificates; analysis pivots two domains to a shared certificate, clusters them to a known loader family, maps that loader to phishing-attachment delivery, and states moderate confidence. Dissemination produces a tactical brief plus a strategic line for the CISO. Feedback records that the PIR was only partly answered, because actor identity remains unresolved. The artefact list alone would not satisfy the requirement - the mapping to delivery behaviour does.
Traps
Confusing tactical with technical: an ATT&CK technique is tactical, a file hash is technical. Treating indicator volume as value. Issuing an assessment with no confidence statement or source evaluation. Using threat and risk interchangeably - risk combines threat, vulnerability, and impact.
Key rules to remember
Requirements precede collection; every judgement carries a confidence level; the higher the detection sits on the Pyramid of Pain, the longer it stays useful.