Threat Intelligence

URL: trusteed.io/academy/glossary/threat-intelligence

Threat intelligence (also called cyber threat intelligence, or CTI) is evidence-based knowledge about existing or emerging threats — including indicators, context, mechanisms, and actionable recommendations — that organizations use to inform security decisions. The critical distinction that separates threat intelligence from a raw threat feed: intelligence has been processed, corroborated, and contextualized enough to actually inform a decision, while a raw feed is simply a list of observations waiting to be interpreted.

What Is Threat Intelligence, Precisely?

A raw indicator — "this IP address was observed in a botnet" — is data, not intelligence. It becomes intelligence once it's enriched with context that makes it actionable: what type of threat is it, how confident is the classification, how recent is the observation, and what should you actually do about it. This distinction matters enormously in practice, because most organizations already have access to plenty of raw threat data through community feeds and commercial subscriptions — the bottleneck is almost never data access, it's turning that data into something a SOC analyst or an automated system can act on in seconds rather than after twenty minutes of manual research.

The Four Types of Threat Intelligence

Strategic intelligence — high-level, non-technical information about the threat landscape, threat actor motivations, and industry-wide trends, typically consumed by executives and used to inform security investment decisions. Tactical intelligence — information about attacker tactics, techniques, and procedures (TTPs), used by security teams to understand how attacks are likely to unfold and to build corresponding defenses. Operational intelligence — details about specific, often imminent attacks or campaigns, including information about particular threat actors or infrastructure. Technical intelligence — the most granular level: specific indicators of compromise (IOCs) like malicious IP addresses, file hashes, and domains, typically consumed directly by security tools for automated detection and blocking.

Why Raw Threat Feeds Create More Problems Than They Solve

Most organizations subscribe to multiple community and commercial threat feeds, and the volume alone creates operational problems: the same indicator often appears across multiple overlapping feeds, generating duplicate alerts for a single event. Mass internet scanners — Shodan, Censys, and dozens of similar tools — generate an enormous share of "suspicious" traffic that represents no targeted threat, yet still triggers alerts if not explicitly filtered. And IP reputation changes fast — an address flagged as malicious last week may be reassigned to a legitimate cloud customer today, meaning stale, un-aged indicators create ongoing false positives long after the actual threat has moved on.

The fix isn't consuming more feeds — it's applying noise-filtering before raw data ever reaches a SOC analyst: deduplicating across sources, suppressing known commodity scanner traffic, aging out stale indicators, and enriching every surviving indicator with behavioral classification and a confidence score. Processing this correctly can reduce raw signal volume by roughly 70% while preserving all genuine security value — the difference between a threat feed and threat intelligence in practice.

How Threat Intelligence Gets Used

SIEM enrichment — attaching threat context to every alert involving an external indicator, so an analyst sees "confirmed botnet node, confidence 0.92, last seen 3 hours ago" instead of a bare IP address requiring manual research. SOAR automation — feeding confidence-weighted intelligence into automated playbooks so high-confidence threats are blocked automatically while ambiguous cases route to human analysts. Firewall/edge enforcement — curated, confidence-scored blocklists that stop confirmed threats at the network edge before they generate an alert at all. Threat hunting — using intelligence about newly discovered campaigns to retroactively search historical logs for activity that predated the indicator's publication.