Threat Intelligence
Knowing who is likely to come for you and how they operate — and turning that into detections rather than a newsletter.
Intelligence, Not Information
Threat intelligence is information about adversaries that has been analysed for your context and can change a decision. A feed of ten thousand malicious IP addresses is data; knowing that a group targeting your sector uses a technique your estate cannot detect is intelligence.
| Level | Audience | Answers |
|---|---|---|
| Strategic | Executives | Who is likely to target us and why — drives investment |
| Operational | Security leadership | Which campaigns and techniques are active now |
| Tactical | Analysts and engineers | Specific behaviours and indicators to detect |
Indicators Versus Behaviours
The Pyramid of Pain ranks what you can detect by how much it costs the adversary to change. Blocking a hash is trivially defeated; detecting the technique forces them to change how they work.
| Detect on | Cost to the adversary |
|---|---|
| File hashes | Trivial — recompile |
| IP addresses | Easy — new infrastructure |
| Domain names | Simple — register another |
| Network or host artefacts | Annoying — retooling required |
| Tools | Challenging — build or buy new ones |
| Tactics and techniques | Genuinely hard — change how they operate |
MITRE ATT&CK
ATT&CK is a public catalogue of adversary tactics and techniques observed in the real world, organised by objective — initial access, persistence, privilege escalation, lateral movement, exfiltration, impact.
| Used for | How |
|---|---|
| Coverage mapping | Which techniques do we detect, and where are the holes |
| Common language | One vocabulary across intel, detection and red team |
| Prioritisation | Focus on techniques used by groups targeting your sector |
| Hunt planning | Pick a technique and go looking for it |
| Purple teaming | Emulate a technique, verify the detection fires |
The Intelligence Lifecycle
| Stage | Detail |
|---|---|
| Direction | What do we actually need to know, and who asked |
| Collection | Feeds, sharing communities, vendor reporting, internal incidents |
| Processing | Normalise, deduplicate, enrich with internal context |
| Analysis | What does this mean for us, specifically |
| Dissemination | To the people who can act, in a form they can use |
| Feedback | Was it useful — refine the direction |
Your own incidents are the highest-quality source you have. They are unquestionably relevant to your estate, and the detections they produce are already tuned to your environment.
Making It Operational
| Practice | Effect |
|---|---|
| Feed indicators into detection automatically | Removes the copy-and-paste step that never happens |
| Enrich alerts with intelligence context | Analysts triage faster with attribution and known behaviour |
| Map detections to ATT&CK | Gaps become visible and plannable |
| Prioritise by sector relevance | Ignore campaigns that will never target you |
| Share back through communities | Sector sharing groups are reciprocal by design |
Interview Questions
What separates intelligence from information?
Analysis for your context and the ability to change a decision. A raw feed of indicators is data; knowing a technique used against your sector is undetectable in your estate is intelligence.
Strategic, operational, tactical — the difference?
Strategic informs executive investment, operational describes active campaigns for security leadership, tactical gives analysts specific behaviours and indicators to detect.
Why prefer behaviours over indicators?
Hashes, IPs and domains are trivially changed. Detecting tactics and techniques forces an adversary to change how they operate, which is genuinely expensive.
What is MITRE ATT&CK used for?
A shared vocabulary and a catalogue of real techniques — used to map detection coverage, prioritise by relevant threat groups, plan hunts and validate detections through emulation.
What is the best source of intelligence?
Your own incidents. They are unquestionably relevant and produce detections already tuned to your environment.
How much does attribution matter?
Less than people assume. It is hard, often wrong, and rarely changes the defensive action — detecting the technique does.