Threat intelligence is analyzed knowledge about adversaries, their methods, and useful indicators, prepared so defenders can decide and act.
It is not your internal ranking of risk, and it is not the hands on search through your own logs.
How it works
Useful intelligence carries context, such as who is targeted and why an indicator matters, rather than a bare list of addresses.
It ranges from a strategic brief to a narrow clue about a current campaign.
Indicators age quickly because attackers change infrastructure and abandon old addresses.
Sources should be ones you can judge, and a block based on a feed should leave a note so analysts can undo mistakes.
Concrete examples
- A brief describes a criminal group that targets payroll staff with invoice fraud.
- A feed lists domains used in a current campaign against your industry.
- An analysis explains a shift in mailbox theft at a high level, without steps to copy it.
Protective measures
- Prefer sources whose methods and limits you can explain to a colleague.
- Expire indicators that are no longer reliable instead of blocking them forever.
- Feed intelligence into assessment and detections rather than storing it unread.
- Record why an indicator was blocked so a later review can correct an error.
Related articles
What is threat assessment? turns outside knowledge into a judgment about which dangers matter to you.
What is threat hunting? uses that knowledge as a hypothesis for a search inside your own environment.
What is the dark web? describes hidden criminal markets that intelligence reports may summarize for defenders.