Threat Intelligence Types and Sources
Distinguish tactical, operational, and strategic intelligence from OSINT, ISACs, and commercial feeds.
What is Threat Intelligence?
Threat intelligence is evidence-based knowledge about threats: TTPs of adversaries, indicators of compromise, malware characteristics, and infrastructure data. It converts raw data into actionable context for security decisions.
Intelligence Types
Strategic: high-level, for executives — threat landscape, sector-specific risks. Operational: campaigns and threat actors. Tactical: TTPs and attack patterns. Technical: IOCs — IPs, domains, hashes.
# Intelligence hierarchy:
# Strategic: "Nation-state actors targeting finance sector"
# Operational: "APT29 using spear phishing in Q3 campaign"
# Tactical: "Uses PowerShell with base64 obfuscation"
# Technical: "C2 IP: 1.2.3.4, Hash: a1b2c3d4..."All lessons in this course
- Threat Intelligence Types and Sources
- MITRE ATT&CK Framework
- STIX, TAXII, and Threat Sharing
- Operationalizing Intel: Threat Hunting