Threat Intelligence
Understanding the threat landscape — what's out there, who's behind it, and what to do about it
What is Threat Intelligence?
Threat intelligence is evidence-based knowledge about existing or emerging threats. It is not just a list of suspicious artifacts. As explained by https://www.recordedfuture.com/threat-intelligence, intelligence turns observations into decision support for defenders, risk owners, and leadership teams.
A practical model is data to information to intelligence. Data is raw material, such as an IP address or hash. Information is enriched data, such as attribution, prevalence, or campaign links. Intelligence is contextualised and actionable judgment, such as deciding to block, monitor, or brief based on confidence and business relevance. This analytic framing aligns with guidance in https://csrc.nist.gov/pubs/sp/800/150/final.
Types of Threat Intelligence
Strategic intelligence describes high-level trends and risk implications for executives. Tactical intelligence focuses on tactics, techniques, and procedures (TTPs) used by adversaries so defenders can improve controls. Operational intelligence tracks active campaigns and imminent threats. Technical intelligence provides indicators of compromise (IOCs) such as domains, hashes, URLs, and IPs.
These types should connect across the organisation. Strategic priorities guide collection, tactical analysis drives detection engineering, operational reporting informs readiness, and technical artifacts feed automation. The https://attack.mitre.org/ knowledge base is commonly used to structure tactical and operational understanding.
Sources of Threat Intelligence
Useful intelligence programs blend open, commercial, government, and community sources. Open source intelligence (OSINT) inputs include ASD alerts, CISA advisories, AlienVault OTX, VirusTotal, and Shodan. Australian advisories are published at https://www.cyber.gov.au/about-us/advisories, and US advisories are published at https://www.cisa.gov/news-events/cybersecurity-advisories.
Commercial sources such as Recorded Future, Mandiant, and CrowdStrike provide additional curation, enrichment, and actor tracking. Community channels, including Information Sharing and Analysis Centers (ISACs), contribute sector-specific observations. Government-to-government sharing, including Five Eyes collaboration, also shapes strategic context. The key is source validation and local relevance, not source volume.
Indicators of Compromise (IOCs)
Indicators of compromise (IOCs) are observable artifacts that may indicate malicious activity. Typical examples include IP addresses, domain names, file hashes, URLs, and email addresses. They are useful for triage and rapid control updates when paired with context and confidence.
In practice, IOCs are used in security information and event management (SIEM) rules, intrusion detection systems (IDS), blocklists, and threat hunting queries. Their limitation is lifespan. Sophisticated adversaries frequently rotate infrastructure and payloads, so IOC-only approaches degrade quickly. Durable detection requires combining IOCs with behaviour analytics and TTP coverage.
Threat Actors
Threat actors include nation-state groups, cybercriminal groups, hacktivists, and insiders. Nation-state examples include APT28 (Fancy Bear), APT41, and Lazarus Group. Cybercriminal examples include ransomware groups such as LockBit and BlackCat. Different actor classes have different intent, resources, and persistence levels.
Analysts track actors using naming conventions, infrastructure overlap, malware reuse, and behavioural patterns. MITRE group profiles at https://attack.mitre.org/groups/ support common reference points, while ASD reporting conventions provide Australian context. The purpose of tracking is to improve detection and prioritisation, not merely to attach labels.
The Australian Threat Landscape
The ASD Annual Cyber Threat Report is a key baseline for Australian organisations and is available at https://www.cyber.gov.au/about-us/reports-and-statistics/asd-cyber-threat-report. It consistently highlights ransomware, business email compromise, supply chain compromise, and exploitation of unpatched internet-facing systems.
For entities covered by the Security of Critical Infrastructure (SOCI) Act, threat intelligence has governance implications as well as operational value. Intelligence should inform incident planning, uplift activities, reporting obligations, and board-level risk discussions. In this context, intelligence is not optional reporting; it is a core input for resilience.
Making Threat Intelligence Actionable
The intelligence cycle is direction, collection, processing, analysis, dissemination, and feedback. Direction defines what decisions need support. Collection gathers internal and external signals. Processing normalises and enriches. Analysis produces judgments and recommendations. Dissemination sends tailored outputs to different audiences. Feedback measures usefulness and refines the next cycle.
Operational impact comes from integration. Intelligence should update SIEM detections, endpoint controls, playbooks, threat hunting hypotheses, vulnerability prioritisation, and risk briefings. Teams that only collect and report intelligence generate noise. Teams that tie intelligence to decisions and control changes reduce measurable exposure.
Continue Learning
- MITRE ATT&CK — Learn how adversary behaviour maps to tactics and techniques.
- STIX & TAXII — Learn how threat intelligence is structured and shared between tools.
- Vulnerability Management — Connect threat context to patching and remediation plans.
- Risk Assessment — Translate cyber findings into business impact and treatment choices.
- See active threats → threat10.link42.app — Explore active intelligence in the threat10 platform.