Threat Intelligence

Threat Intelligence refers to the systematic collection, analysis and processing of information about cyber threats, threat actors and their methods. Data sources can include security events, malware analysis, vulnerability databases, external threat feeds and publicly available information. The resulting intelligence can provide Indicators of Compromise, attack techniques and information about known threat actors. Threat Intelligence helps security teams assess relevant threats, identify attacks at an early stage and prioritise appropriate security measures. The information can be integrated into security technologies such as SIEM, EDR, firewalls and SOAR platforms. Depending on its purpose and level of detail, Threat Intelligence is commonly classified as strategic, tactical, operational or technical intelligence.