Threat intelligence: definition
Threat intelligence is the body of information about cyber threats (who is attacking, by what means, against whom) collected, analysed and related to an organisation's context, to help it make defence decisions.
In short
A list of malicious IP addresses is data. Knowing that a criminal group is hitting companies in your industry by exploiting a VPN that you use too is intelligence: information that is relevant, timely and actionable. The whole difference lies in relevance.
How it works
Threat intelligence follows a cycle: you establish what you need to know, gather the sources, process and analyse the data, distribute the results to those who need to use them, and collect feedback to improve. Four levels are usually distinguished:
- strategic: trends and risks for management (which threats are growing in your industry);
- operational: campaigns under way and active groups, useful to those who manage security;
- tactical: attackers' techniques and procedures, often described with MITRE ATT&CK;
- technical: indicators of compromise to look for in your systems.
The sources range from vendor advisories and national CSIRTs, such as CSIRT Italia, Italy's national CSIRT, to researchers' blogs, industry sharing groups and dark web monitoring.
Why it matters
No company can read everything that is published about security. Without a filter, the important news gets lost among the irrelevant. Good threat intelligence tells you early about what concerns your products, your suppliers and your industry, so you can update, mitigate or look for traces before it is too late. The NIS2 Directive explicitly encourages organisations to share this information with one another.
Example
A logistics company sets up alerts on three keywords: the name of the firewall it uses, its warehouse management software and its main IT supplier. One Tuesday morning it receives a digest: an advisory from the firewall vendor reports a vulnerability that is being actively exploited, with a temporary mitigation pending the patch. The IT contact applies the mitigation the same day, instead of finding out weeks later from a news story. This is the typical zero-day scenario.
The value does not lie in the number of sources followed, but in relevance: ten news items a day about products you do not use become noise, and noise makes you miss the one that matters.
Related terms
Where you find it in Dottor Box
The Threat Intelligence module reads predefined security sources and the feeds you add yourself, and sends you a digest by email when an article matches your keywords, never notifying the same news item twice. Dark Web Monitoring adds exposed credentials and mentions on leak sites.
Threat Intelligence
News and threats that concern your industry and your suppliers, gathered into a digest.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more