0Pricing
Cyber Security Academy · Lesson

Threat Intelligence Types and Sources

Distinguish tactical, operational, and strategic intelligence from OSINT, ISACs, and commercial feeds.

Threat Intelligence Types and Sources is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Threat Intelligence?

Threat intelligence is evidence-based knowledge about threats: TTPs of adversaries, indicators of compromise, malware characteristics, and infrastructure data. It converts raw data into actionable context for security decisions.

Intelligence Types

Strategic: high-level, for executives — threat landscape, sector-specific risks. Operational: campaigns and threat actors. Tactical: TTPs and attack patterns. Technical: IOCs — IPs, domains, hashes.

# Intelligence hierarchy:
# Strategic: "Nation-state actors targeting finance sector"
# Operational: "APT29 using spear phishing in Q3 campaign"
# Tactical:    "Uses PowerShell with base64 obfuscation"
# Technical:   "C2 IP: 1.2.3.4, Hash: a1b2c3d4..."

OSINT Sources

Open-source intelligence is free and abundant. Key sources: VirusTotal (file/URL/IP reputation), Shodan (internet device search), Censys, AlienVault OTX, Abuse.ch, and ThreatFox for IOC feeds.

# Free OSINT threat intel tools:
# VirusTotal: https://www.virustotal.com
# AlienVault OTX: https://otx.alienvault.com
# Abuse.ch: https://abuse.ch (malware + botnet)
# ThreatFox: https://threatfox.abuse.ch
# URLhaus: https://urlhaus.abuse.ch
# MISP: self-hosted sharing platform

Commercial Threat Feeds

Commercial feeds (Recorded Future, CrowdStrike Intelligence, Mandiant) provide curated, contextualized intelligence with analyst-enriched profiles of threat actors, campaigns, and attribution data.

ISACs: Sector-Specific Sharing

ISACs (Information Sharing and Analysis Centers) aggregate and share threat intelligence within industry sectors: FS-ISAC (financial), H-ISAC (healthcare), E-ISAC (energy). Members share IOCs and TTPs anonymously.

Government Sources

CISA (US), NCSC (UK), and other national CERTs publish advisories, IOCs, and technical alerts. CISA's Known Exploited Vulnerabilities catalog and AA (Activity Alerts) are high-value free sources.

# Key government intel sources:
curl https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

# NIST NVD
https://nvd.nist.gov/

# NCSC advisories
https://www.ncsc.gov.uk/section/keep-up-to-date/threat-reports

Dark Web Intelligence

Dark web forums, paste sites, and underground markets are monitored by threat intelligence vendors for: credential dumps, exploit sales, ransomware communications, and initial access broker listings. Requires careful legal and operational handling.

IOC Types and Limitations

Technical IOCs: IP addresses, domain names, file hashes, URL patterns, email subjects. IOCs have a short lifespan — attackers rotate infrastructure. Behavioral TTPs persist longer and are more valuable for detection.

# IOC types by longevity (Pyramid of Pain):
# Hash:        Trivial to change (least valuable)
# IP:          Easy to change
# Domain:      Easy to change
# Host artifacts: Harder
# Network/Behavioral: Hard
# TTPs:        Very hard to change (most valuable)

Evaluating Source Reliability

Not all feeds are equal. Evaluate: freshness (how recent?), accuracy (false positive rate), relevance (your sector/geography?), and coverage (completeness). Poor-quality feeds generate more noise than signal.

Operationalizing Intelligence

Intelligence only has value when acted on. Integrate IOC feeds into: firewall blocklists, SIEM lookup tables, endpoint EDR indicators, email gateway reputation checks, and proxy URL filtering.

# SIEM IOC lookup example (Splunk):
index=dns
| lookup threat_intel_ips clientip AS src_ip OUTPUT threat_category
| where isnotnull(threat_category)
| table _time, src_ip, dest, threat_category

Intelligence Lifecycle

The intelligence cycle: Direction (what do we need to know?) → Collection → Processing → Analysis → Dissemination → Feedback. Treat intelligence as a continuous process, not a one-time data dump.

Quick Check

Which IOC type is most valuable according to the Pyramid of Pain?

Summary: Threat Intelligence Sources

Threat intelligence ranges from free OSINT (VirusTotal, AlienVault OTX, CISA KEV) to commercial feeds with deep actor profiles. Use the Pyramid of Pain to prioritize behavioral TTPs over easily-rotated IOCs. Feed intelligence into SIEM, EDR, and network controls. Treat it as a cycle — collect, analyze, act, and refine based on feedback.

Frequently asked questions

Is the “Threat Intelligence Types and Sources” lesson free?

Yes — the full text of “Threat Intelligence Types and Sources” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Threat Intelligence Types and Sources”?

Distinguish tactical, operational, and strategic intelligence from OSINT, ISACs, and commercial feeds. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Threat Intelligence Types and Sources” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Threat Intelligence Types and Sources
  2. MITRE ATT&CK Framework
  3. STIX, TAXII, and Threat Sharing
  4. Operationalizing Intel: Threat Hunting
← Back to Cyber Security Academy