Proactive Threat Detection · Topic 1 of 5
Threat Intelligence Concepts, Types and Strategies
Learn what threat intelligence is, its lifecycle, the strategic, tactical, operational and technical types, and how to plan a strategy for CSA 312-39.
- 4 min
- Includes a diagram
- Intelligence is analyzed, relevant and actionable; raw feeds are only data.
- Lifecycle: planning and direction, collection, processing and exploitation, analysis and production, dissemination and integration.
- Strategic for executives, tactical (TTPs) for managers, operational for responders, technical (IoCs) for SOC tools.
What it is
Cyber threat intelligence (CTI) is evidence based knowledge about threats, such as who the adversaries are, what they want, how they operate and which indicators reveal them, that has been analyzed so an organization can make decisions. It moves the SOC from reacting to alerts toward anticipating attacks.
The key idea is the difference between data, information and intelligence.
| Level | Example | Value |
|---|---|---|
| Data | A list of IP addresses from a feed | Raw facts, no context |
| Information | Those addresses were seen scanning banks last week | Facts with some context |
| Intelligence | A group using these addresses targets banks in our region with a known exploit; patch it and block these | Analyzed, relevant, actionable |
How it works
The threat intelligence lifecycle
| Phase | What happens |
|---|---|
| Planning and direction | Define intelligence requirements: what the organization needs to know and why |
| Collection | Gather data from internal and external sources |
| Processing and exploitation | Convert, decode, translate, normalize and de-duplicate the data |
| Analysis and production | Analysts interpret the data, link it to the organization and produce findings |
| Dissemination and integration | Deliver the right product to each audience and feed indicators into tools |
Feedback from consumers flows back into planning, so the cycle repeats and improves.
Good intelligence is relevant to the organization, timely, accurate and actionable. Intelligence that arrives late or does not apply is noise.
The four types of threat intelligence
| Type | Focus | Consumers | Timeframe |
|---|---|---|---|
| Strategic | High level trends, risks, threat actors' motives, financial and business impact | Executives, board, CISO | Long term |
| Tactical | Adversary tactics, techniques and procedures (TTPs) | Security managers, SOC managers, architects, administrators | Long term |
| Operational | Specific upcoming or ongoing attacks: nature, intent, timing, targets | Security managers, incident response heads, network defenders, forensic teams | Short term |
| Technical | Indicators of compromise: IP addresses, domains, URLs, file hashes, email subjects | SOC analysts, incident responders, security tools | Short term |
Strategic intelligence is mostly reports and briefings in business language. Technical intelligence is machine readable and loaded straight into a SIEM, firewall or EDR.
Technical indicators lose value quickly because attackers change addresses and hashes. TTPs change slowly, so tactical intelligence stays useful longer. This is the same idea as the Pyramid of Pain.
Threat intelligence strategy
A threat intelligence program needs a plan, not just feeds. A practical strategy covers these points:
- Set intelligence requirements. Priority intelligence requirements (PIRs) state the key questions, such as "Which ransomware groups target our sector?"
- Know the organization. Critical assets, technology in use, threat landscape for the sector and region.
- Choose sources that answer the requirements, and assess their reliability.
- Define processes for collection, analysis, dissemination and feedback.
- Integrate with operations. Feed the SIEM, SOAR, EDR and firewalls, and brief the right people.
- Share with trusted communities such as an ISAC, following agreed handling rules such as the Traffic Light Protocol (TLP).
- Measure whether intelligence led to blocked attacks, faster triage or better decisions, and adjust.
TLP labels show how widely intelligence may be shared: TLP:RED, TLP:AMBER (and AMBER+STRICT), TLP:GREEN and TLP:CLEAR.
A worked example
A manufacturing company's CISO wants to know whether ransomware is a real risk for next year's budget. The intelligence team produces a strategic report on sector trends and likely business impact. For the SOC manager, it produces tactical guidance on the TTPs of the groups most active in manufacturing.
When a feed later reports a live campaign against a peer company, operational intelligence warns incident response, and technical indicators from the campaign go straight into the SIEM and firewall blocklists.
How the exam asks about this
- "Which type of threat intelligence covers adversary TTPs and is consumed by security managers and architects?" → Tactical.
- "A SOC loads a list of malicious hashes and domains into its SIEM. Which type of intelligence is this?" → Technical.
- "In which lifecycle phase are intelligence requirements defined?" → Planning and direction.
What to remember for the exam
- Intelligence is analyzed, relevant and actionable; raw feeds are only data.
- Lifecycle: planning and direction, collection, processing and exploitation, analysis and production, dissemination and integration.
- Strategic for executives, tactical (TTPs) for managers, operational for responders, technical (IoCs) for SOC tools.
- Strategic and tactical are long term; operational and technical are short term.
- A strategy starts with intelligence requirements and ends with measuring value.
Operational and technical intelligence are easy to confuse. Operational is about a specific attack and its intent and timing; technical is the indicators themselves.
Common mistakes
Calling every feed "intelligence." A feed with no context or relevance check is data, and loading it blindly causes false positives.
Giving executives technical indicators. Leaders need strategic intelligence: risk, trends and business impact.
Skipping requirements. Without PIRs, the team collects everything and answers nothing.
Check yourself
What turns information into intelligence?
Analysis that links it to the organization so it supports a decision or action.
Which intelligence type has the shortest useful life, and why?
Technical intelligence, because attackers change addresses, domains and hashes quickly.
What does the Traffic Light Protocol control?
How widely a piece of shared intelligence may be passed on.
Topic 1 of 5 in Proactive Threat Detection
Test yourself on Proactive Threat Detection
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.