Proactive Threat Detection · Topic 2 of 5
Threat Intelligence Sources and Platforms
Learn the threat intelligence sources a SOC uses, from OSINT to ISACs and internal logs, plus STIX, TAXII and what a TIP does for the CSA 312-39 exam.
- 4 min
- Sources include OSINT, commercial, community (ISACs), government, internal and dark web.
- Internal data is often the most relevant source.
- Judge sources on relevance, timeliness, reliability, context and format.
What it is
A SOC collects threat intelligence from many sources: public, commercial, community, government and its own internal data. Each source differs in cost, reliability, timeliness and relevance.
A threat intelligence platform (TIP) is the tool that brings those sources together. It collects, normalizes, de-duplicates, scores and enriches intelligence, and pushes it to the SOC's security tools.
How it works
Intelligence source categories
| Source | Examples | Notes |
|---|---|---|
| Open source (OSINT) | Public blocklists, security blogs, vendor reports, vulnerability databases, social media | Free, broad, needs vetting |
| Commercial feeds | Paid vendor intelligence services | Curated and supported, costly |
| Community and sharing groups | ISACs (Information Sharing and Analysis Centers), sector groups, MISP communities | Highly relevant to the sector, based on trust |
| Government | National CERTs and agencies such as CISA advisories | Authoritative alerts on major threats |
| Internal | SIEM logs, past incidents, EDR detections, phishing reports, honeypots | Most relevant, often underused |
| Human intelligence (HUMINT) | Contacts, interviews, researcher networks | Context that machines miss |
| Dark web and underground forums | Leaked credentials, access sales, attack planning | Needs care and legal approval |
| Technical intelligence (TECHINT) | Malware analysis, sandbox output, scan data | Produces indicators and behaviors |
Internal intelligence is often the best source, because it shows what is actually hitting this organization.
Judging a source
| Question | Why it matters |
|---|---|
| Is it relevant to our sector, region and technology? | Irrelevant intelligence adds noise |
| Is it timely? | Indicators age fast |
| Is it reliable and accurate? | False indicators cause false positives and business disruption |
| Does it include context? | Context such as the related actor and technique makes it actionable |
| Is it in a usable format? | Machine readable formats can be automated |
Sharing standards
| Standard | Purpose |
|---|---|
| STIX (Structured Threat Information Expression) | A language and format for describing threat intelligence, such as indicators, threat actors, attack patterns and malware |
| TAXII (Trusted Automated Exchange of Intelligence Information) | A protocol for exchanging STIX content over HTTPS |
| TLP (Traffic Light Protocol) | Labels that state how widely intelligence may be shared |
A simple way to remember it: STIX is what is shared, TAXII is how it is transported.
What a TIP does
| Capability | What it gives the SOC |
|---|---|
| Aggregation | Pulls in many feeds and formats in one place |
| Normalization and de-duplication | One clean record per indicator |
| Enrichment | Adds context such as related actors, campaigns and reputation |
| Scoring and aging | Rates confidence and expires stale indicators |
| Correlation | Links indicators to campaigns and to the SOC's own sightings |
| Analysis workspace | Lets analysts investigate and write reports |
| Integration | Pushes indicators to SIEM, SOAR, EDR, firewall, proxy and email gateway |
| Sharing | Exchanges intelligence with partners over STIX and TAXII |
Well known examples include MISP (open source), OpenCTI (open source), ThreatConnect and Anomali ThreatStream.
A worked example
A SOC subscribes to five feeds. The same malicious domain appears in three of them with different scores, and an old address from one feed keeps triggering alerts on a cloud provider range now used by a legitimate partner.
A TIP fixes both. It merges the duplicate domain into one record with combined confidence, and its aging rule expires the old address after its validity period, so the false alerts stop.
How the exam asks about this
- "Which standard defines the format for describing threat intelligence such as indicators and threat actors?" → STIX.
- "Which sector based group lets organizations share threat intelligence with peers?" → An ISAC.
- "Which tool aggregates threat feeds, removes duplicates, scores indicators and sends them to the SIEM?" → A threat intelligence platform (TIP).
What to remember for the exam
- Sources include OSINT, commercial, community (ISACs), government, internal and dark web.
- Internal data is often the most relevant source.
- Judge sources on relevance, timeliness, reliability, context and format.
- STIX describes intelligence; TAXII transports it; TLP limits sharing.
- A TIP aggregates, normalizes, de-duplicates, enriches, scores, ages and distributes intelligence.
More feeds do not mean better intelligence. Each new feed adds duplicates and false positives unless a TIP or analyst vets and scores it.
Common mistakes
Swapping STIX and TAXII. STIX is the content format, TAXII is the exchange protocol.
Confusing a TIP with a SIEM. A SIEM collects and correlates the organization's own events. A TIP manages external and internal intelligence and feeds it to the SIEM.
Never expiring indicators. Addresses and domains get reused by legitimate services, so stale indicators cause false positives.
Check yourself
Why is internal data a valuable intelligence source?
It shows the threats actually targeting the organization, so it is highly relevant.
What does TAXII do?
It is a protocol for exchanging threat intelligence, usually STIX content, over HTTPS.
What are two tasks a TIP performs?
Any two of aggregating feeds, removing duplicates, enriching, scoring and aging indicators, and pushing them to security tools.
Topic 2 of 5 in Proactive Threat Detection
Test yourself on Proactive Threat Detection
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.