What is Threat Intelligence?

Threat Intelligence, also known as TI and Cyber Threat Intelligence also known as, CTI, is used to provide information about the threat landscape specifically adversaries and their TTPs. Typically CTI revolves around APT groups and/or other threats, these can be well-known groups or up and coming new threats.

Data must be analyzed to be considered threat intelligence. Once analyzed and actionable, then it becomes threat intelligence. The data needs context around to become intel.

CTI is a precautionary measure that companies use or contribute to so that other corporations do not get hit with the same attacks. Of course, adversaries change their TTPs all the time so the TI landscape is constantly changing.

Vendors and corporations will sometimes share their collected CTI in what are called ISACs or Information Sharing and Analysis Centers. ISACs collect various indicators of an adversary that other corporations can use as a precaution against adversaries.

If you are not familiar with adversaries and their TTPs I would suggest checking out the following resources.

• APT Groups and Operations

• Tryhackme Mitre Room

• FireEye APT Report

Threat Intelligence is also broken up into three different types.

• Strategic

Assist senior management make informed decisions specifically about the security budget and strategies.

• Tactical

Interacts with the TTPs and attack models to identify adversary attack patterns.

• Operational

Interact with IOCs and how the adversaries operationalize.

In this room, we will mainly be focusing on Operational CTI but all forms of threat intelligence have their place and I encourage you to research each thoroughly.