Threat Data Collection and Sources
The Collection domain tests collection planning, source selection and source-quality judgment - whether you can justify where an indicator or assessment came from.
Requirements before collection
Collection starts with Priority Intelligence Requirements derived from the organisation's risk profile. A PIR states the question, the decision it supports, the sources, the frequency and the owner. Without a PIR you are data hoarding, not collecting.
Source categories
- Internal telemetry: EDR, proxy, DNS, NetFlow, email gateway, honeypots. Highest relevance, lowest breadth.
- OSINT: vendor research, CERT advisories, government (CISA, NCSC), social media, paste sites, job postings, code repositories.
- Commercial/closed: curated feeds, dark web monitoring, malware intelligence, attribution services.
- Community sharing: ISACs, MISP communities, FIRST, TLP-controlled groups.
- HUMINT and technical collection: industry contacts, law enforcement, conferences, sandboxes, scanners, sinkholes.
Scoring quality
Use the Admiralty code: source reliability (A–F) is rated separately from information credibility (1–6). An A1 report and a C3 report must not be weighted the same. Also judge timeliness, relevance, completeness and cost. Normalise and deduplicate before ingestion; one IOC arriving from five feeds is one IOC, not five corroborations.
Worked example
PIR: "Is ransomware targeting our sector preparing to exploit our VPN vendor?" Collect internal VPN logs and EDR (answers exposure, not intent), the vendor advisory, the sector ISAC, a commercial feed, and leak-site monitoring. Two independent sources describing the same exploitation campaign raise credibility to "likely"; a single blog repeating an unverified tweet does not.
Traps that cost marks
Treating feed volume as coverage, ignoring terms of service and privacy law when scraping, and confusing source reliability with information credibility. Free feeds carry bias, and social posts need corroboration before entering a blocklist.