Threat Intelligence.

Threat intelligence is the structured collection, processing, analysis and dissemination of information about adversaries, their motivations, capabilities and infrastructure. It transforms raw data (malware samples, IPs, domains, leaked credentials, dark-web chatter, vulnerability reports) into actionable intelligence by adding context, confidence and a relevant audience. Most programmes run some form of the intelligence cycle — direction, collection, processing, analysis, dissemination and feedback — so that output is tied to concrete decisions rather than raw feeds.

A useful prioritisation model is David Bianco's Pyramid of Pain (2013): indicators are ranked by how much it hurts an adversary to change them. Hash values and IP addresses sit at the bottom (trivially rotated), then domain names, host and network artifacts, tools, and finally TTPs at the apex — behaviours an actor cannot easily abandon. Detecting at the TTP level (mapped to MITRE ATT&CK) imposes far more cost than blocking a throwaway IP. Organizations exchange intelligence through structured formats and feeds — STIX/TAXII, MISP, vendor reporting and sector ISACs — to enrich SIEM and EDR detections, guide patching (e.g. correlating CISA KEV entries with exposed assets) and inform executive risk decisions. Intelligence is typically classified by audience and time horizon into strategic, operational and tactical levels; the discipline's value depends on relevance, timeliness and accuracy, not volume of indicators.

flowchart LR
  A[Direction<br/>intel requirements] --> B[Collection<br/>feeds, OSINT, dark web]
  B --> C[Processing<br/>normalize, dedupe]
  C --> D[Analysis<br/>context, attribution, ATT&CK]
  D --> E[Dissemination<br/>STIX/TAXII, TIP, reports]
  E --> F[Consumers<br/>SIEM, EDR, IR, execs]
  F --> A