What is Threat Intelligence?

This is the first blog in a series titled, "What is Threat Intelligence?". Continue with the series at the bottom of this page. <h3>Written by Steve Miller and Payton Bush</h3> Threat intelligence is a subset of intelligence focused on information security. Gartner (sorry, people) defines threat intelligence as “evidence-based knowledge...about an existing or emerging menace or hazard...to inform decisions regarding the subject’s response to that menace or hazard.” In short, threat intelligence is curated information intended to inform you and help you make better decisions about how to stop bad things from happening to you. There are a few schools of thought and several sets of vernacular used to describe cyber threat intelligence. But there are generally three “levels” of cyber threat intelligence: strategic, operational and tactical. Some of the similarities and differences between these kinds of intelligence are summarized below: Collecting each flavor of intelligence is important because they serve different functions. <table class="table table-bordered table-striped"> <tbody> <tr> <td style="text-align: center;">Type</td> <td style="text-align: center;">Tagline</td> <td style="text-align: center;">Half life of utility (for good guys and bad guys)</td> <td style="text-align: center;">Focus</td> <td style="text-align: center;">Built on the analysis of</td> <td style="text-align: center;">Output data types</td> </tr> <tr> <td style="text-align: center;">Strategic</td> <td> Who? Why? </td> <td style="text-align: center;">Long (multiyear)</td> <td style="text-align: center;">Non-technical</td> <td style="text-align: center;">Big campaigns, groups, multi victim intrusions (and operational intel)</td> <td style="text-align: center;">Long form writing about: victimology, YoY methodology, mapping intrusions and campaigns to conflicts, events and geopolitical pressures</td> </tr> <tr> <td style="text-align: center;">Operational</td> <td> How? Where? </td> <td style="text-align: center;">Medium (one year plus)</td> <td style="text-align: center;">Mixed (both really)</td> <td style="text-align: center;">Whole malware families, threat groups, human behavior analysis (and tactical intel)</td> <td style="text-align: center;">Short form writing, bulleted lists, about: persistence and comms techniques, victims, group profiles, family profiles, TTP descriptions, triggers, patterns, and methodology rules</td> </tr> <tr> <td style="text-align: center;">Tactical</td> <td style="text-align: center;">What?</td> <td style="text-align: center;">Short (months)</td> <td style="text-align: center;">Technical</td> <td style="text-align: center;">Security events, individual malware samples, phishing emails, attacker infrastructure</td> <td style="text-align: center;">Atomic and machine-readable indicators such as IPs, domains, IOCs, “signatures”</td> </tr> </tbody> </table> Analysts deal with a lot of alerts. Alerts enriched with tactical intelligence provide more context and help analysts determine which threats are worth worrying about and which can safely be ignored. These atomic indicators are often changed quickly though, making it important to also incorporate operational and strategic intelligence into decisions. Operational intelligence helps fuel meaningful detection, incident response and hunting programs. For example, it can help identify patterns in attacks with which we can create logical rules in tech systems that will detect malicious activity specific indicators. Strategic intelligence can help with assessing and mitigating current and future risks to organizations. For example, a corporation releasing a new product or completing a merger will want to understand not only the potential impact but also the associated risks. This intelligence is particularly useful for people in leadership roles such as CISOs and executive leadership who must justify budgets and make better informed investment decisions. The sum of these different kinds of threat intelligence is the ability to make informed decisions on how to proactively and reactively respond to threats. This includes what solutions to use, how they should be leveraged, and even just who to keep tabs on. Check out the other blogs in our series for a deeper look into what these three kinds of intelligence look like and how they’re used. <a href="https://www.anomali.com/blog/what-is-strategic-threat-intelligence">What is Strategic Threat Intelligence?</a> <a href="https://www.anomali.com/blog/what-is-operational-threat-intelligence">What is Operational Threat Intelligence?</a> <a href="https://www.anomali.com/blog/what-is-tactical-threat-intelligence">What is Tactical Threat Intelligence?</a>