Threat Intelligence: How Defenders Learn to Think Like Attackers

The 30-second explanation

It is like a neighbourhood watch bulletin for the internet: what kinds of break-ins are happening, how they are being done, and what to lock first.

How it works

1. 1

   1. Collect

   Gather reports, feeds and observations.

2. 2

   2. Analyse

   Check reliability and add context.

3. 3

   3. Share

   Deliver it to the people who can use it.

4. 4

   4. Act

   Search, block, or improve detection.

Raw information about attacks is everywhere: lists of bad websites, reports on how a campaign worked, notes from other defenders. On its own it is noise. Threat intelligence is what you get when someone checks that information, adds context, and explains why it matters to you. The key question is always: what should we do differently because of this? Some intelligence is high level, such as which attackers are interested in your industry; some is specific, such as a website address or file fingerprint to search for.

Real-world example

How to spot it

• Stale indicators

  A domain or file hash that is no longer in active use has limited value.

• Weak sourcing

  A claim with no explanation of how it was verified deserves less confidence.

• No matching detection

  Intelligence that never turns into a search or a rule doesn't help anyone.

• No fit to your environment

  A finding that doesn't map to anything you actually run isn't worth acting on.

What to do

1. 1Ask what changed because of a piece of intelligence — if nothing did, it wasn't actionable.
2. 2Prioritise behaviours over one-off indicators; they last far longer.
3. 3Retire indicators that have expired instead of letting stale data pile up.