Security Operations · Topic 6 of 10
Threat Intelligence Concepts
Threat intelligence types, sources, IOCs versus TTPs, the intelligence cycle, STIX and TAXII, the Traffic Light Protocol and TIPs for CySA+ candidates.
- 6 min
- Includes a diagram
- Intelligence is analysed information that supports a decision, not just raw data.
- The cycle is requirements, collection, processing, analysis, dissemination and feedback.
- Strategic is for executives, operational for responders and managers, tactical for analysts and engineers.
What it is
Threat intelligence is information about adversaries, their methods and their targets that has been analysed so it can support a decision. Raw data, such as a list of bad addresses, becomes intelligence when it is checked, put in context and tied to an action.
Good intelligence is relevant to your organisation, timely and accurate. A feed full of threats against industries you do not serve adds noise instead of value.
How it works
The intelligence cycle
The cycle is a loop: set requirements, collect data, process it, analyse it, share it, and gather feedback to improve the next round. The feedback step matters because consumers tell the producers whether the output was useful.
Types by audience
| Type | Audience | Example |
|---|---|---|
| Strategic | Executives and planners | Which threat groups target our sector and why |
| Operational | Security managers, incident responders | Details of a coming campaign, timing and methods |
| Tactical | Analysts and engineers | Attacker techniques, tools and procedures |
Many courses also describe technical intelligence as the machine readable indicators, such as addresses, domains and file hashes, that tools can use directly.
Sources
- Open source intelligence (OSINT): public reports, blogs, social media, vulnerability databases and paste sites.
- Information Sharing and Analysis Centers (ISACs): sector groups where members share threat details with each other.
- Commercial feeds and vendor research: paid, often richer and better curated.
- Government and national computer emergency response team (CERT) alerts.
- Internal data: your own logs, past incidents and honeypots, which are often the most relevant source.
- Dark web and criminal forums, collected carefully by specialists.
Judge each source on reliability (has it been right before) and the credibility of the individual report. A reliable source can still send a weak report.
Threat actors and attribution
An advanced persistent threat (APT) is a well resourced, skilled group that targets chosen victims over a long period and works to stay hidden. Many are linked to nation states and seek espionage or strategic advantage. They contrast with other actors.
| Actor | Usual motive | Typical behaviour |
|---|---|---|
| APT | Espionage, strategic goals | Targeted, patient, stealthy, custom tools, long dwell time |
| Organised criminals | Money | Ransomware and fraud, run like a business |
| Hacktivists | A political or social cause | Defacement, denial of service, data leaks for publicity |
| Script kiddies | Curiosity or status | Ready made tools, opportunistic and noisy |
Attribution is linking activity to a named actor or group. It is difficult and often low confidence, because groups reuse common tools and infrastructure, relay through compromised hosts, and can plant false flags such as misleading language or time zones.
For most defenders, behaviour matters more than the name. Detections built on TTPs work whoever the actor is, while attribution mainly supports strategic assessments and legal or government action. State the confidence level of any attribution claim.
Indicators and behaviours
An indicator of compromise (IOC) is a specific artefact such as a hash, address or domain. Tactics, techniques and procedures (TTPs) describe how an adversary operates.
IOCs go stale fast because attackers change infrastructure easily. TTPs last longer, since changing habits is harder. The Pyramid of Pain is a popular model that shows hash values as trivial for an attacker to change and TTPs as the most costly to change, so detections based on behaviour hurt attackers most.
Sharing standards
| Standard | Purpose |
|---|---|
| Structured Threat Information eXpression (STIX) | A common language for describing threat information |
| Trusted Automated eXchange of Indicator Information (TAXII) | A transport method for exchanging STIX content |
| Traffic Light Protocol (TLP) | Labels that say how widely information may be shared |
TLP uses colours. TLP:RED is for the named recipients only, TLP:AMBER limits sharing to the recipient's organisation (and its clients) on a need to know basis, TLP:GREEN allows sharing within the wider community but not public posting, and TLP:CLEAR has no restriction. TLP:CLEAR was called TLP:WHITE in older versions, and TLP:AMBER+STRICT narrows amber to the recipient's own organisation.
Threat intelligence platforms
A threat intelligence platform (TIP) gathers feeds from many sources, removes duplicates, scores and enriches indicators, and sends the useful ones to the Security Information and Event Management (SIEM) platform, firewalls and Endpoint Detection and Response (EDR) tools. Analysts also use it to look up an address or hash during an investigation.
Typical enrichment answers four questions: has this indicator been seen before, who is linked to it, how confident is the source, and how long is it valid?
Using intelligence
- Block or alert on matching indicators.
- Search past logs for the same indicators to see if you were already hit.
- Prioritise patching for flaws that attackers are actively using.
- Feed hunting hypotheses and detection rules.
- Brief leaders on the threat picture.
Threat modeling with STRIDE
Threat modeling looks at a system design, often a data flow diagram, to find what could go wrong before an attack happens. STRIDE is a checklist of six threat categories, and each one breaks a security property.
| Letter | Threat | Property broken | Example |
|---|---|---|---|
| S | Spoofing | Authentication | A forged sender address or stolen session token |
| T | Tampering | Integrity | Altering a price in a request or editing a log |
| R | Repudiation | Non repudiation | A user denies deleting a file and no audit log exists |
| I | Information disclosure | Confidentiality | A public storage bucket or a verbose error message |
| D | Denial of service | Availability | Flooding a service until it stops answering |
| E | Elevation of privilege | Authorisation | A normal user gains administrator rights through a flaw |
Apply the six questions to each component and data flow, record the threats found, and choose a control for each.
What to remember for the exam
- Intelligence is analysed information that supports a decision, not just raw data.
- The cycle is requirements, collection, processing, analysis, dissemination and feedback.
- Strategic is for executives, operational for responders and managers, tactical for analysts and engineers.
- OSINT is public data, and ISACs are sector sharing groups.
- IOCs are specific artefacts and expire quickly, while TTPs describe behaviour and last longer.
- STIX is the language, TAXII is the transport, and TLP sets sharing limits.
- A TIP aggregates, enriches and distributes intelligence to security tools.
- Source reliability and information credibility are judged separately.
When a question mentions both a data format and a way to exchange it, STIX is the format and TAXII is the delivery mechanism.
Common mistakes
Treating all feeds as equal. Volume is not value, and an unvetted feed can cause false positives and blocked business traffic.
Relying only on IOCs. A hash or address changes easily, so behaviour based detection is more durable.
Mixing up STIX and TAXII. One describes the content and the other moves it.
Ignoring sharing labels. Passing TLP:RED information to people who were not named breaks the sender's rules.
Collecting without a requirement. If nobody knows what decision the data supports, it will pile up unused.
Check yourself
Which intelligence type is aimed at executives?
Strategic intelligence.
What are STIX and TAXII?
STIX is a standard format for threat information, and TAXII is the protocol used to exchange it.
Why are TTPs more valuable than IOCs for lasting detection?
Attackers can change addresses and files easily, but changing their working methods is much harder.
Topic 6 of 10 in Security Operations
Test yourself on Security Operations
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.