Practice intelligence workflows before moving to reading resources.

Opening Framing: Intelligence-Driven Security

Without threat intelligence, defenders are blind. We react to alerts without understanding the bigger picture. We don't know who's attacking us, what they want, or how they operate.

Threat intelligence changes this. It provides context about adversaries—their tactics, techniques, infrastructure, and motivations. With good intelligence, we can anticipate attacks, prioritize defenses, and respond more effectively.

This week covers threat intelligence fundamentals: what it is, where it comes from, how to use it in SOC operations, and how to produce intelligence from your own incidents.

Key insight: Intelligence without action is trivia. The value of threat intelligence comes from applying it to improve detection, prevention, and response.

1) Threat Intelligence Fundamentals

Understanding what threat intelligence is and isn't:

Threat Intelligence Defined:

"Evidence-based knowledge about existing or emerging 
threats that can be used to inform decisions."

Key elements:
- Evidence-based (not speculation)
- Actionable (informs decisions)
- Contextual (explains the "so what")
- Timely (relevant to current threats)

What threat intelligence is NOT:
- Raw data (that's just information)
- Vendor marketing
- Generic threat reports
- Unvetted IOC lists

Intelligence Levels:

Strategic Intelligence:
- Audience: Executives, board, leadership
- Timeframe: Months to years
- Content: Threat landscape, risk trends, adversary motivations
- Format: Reports, briefings
- Example: "Nation-state actors targeting our industry are 
  increasing in sophistication"

Operational Intelligence:
- Audience: Security managers, IR leads
- Timeframe: Days to weeks
- Content: Active campaigns, adversary capabilities, TTPs
- Format: Reports, advisories
- Example: "APT29 is conducting phishing campaign targeting 
  energy sector using COVID-19 lures"

Tactical Intelligence:
- Audience: SOC analysts, detection engineers
- Timeframe: Hours to days
- Content: IOCs, detection signatures, attack patterns
- Format: IOC feeds, YARA rules, detection rules
- Example: "Block IP 185.x.x.x - active C2 server"

The Intelligence Cycle:

    ┌─────────────────────────────────────┐
    │                                     │
    ▼                                     │
┌────────────┐                            │
│ Direction  │ ← What do we need to know? │
└─────┬──────┘                            │
      ↓                                   │
┌────────────┐                            │
│ Collection │ ← Gather raw information   │
└─────┬──────┘                            │
      ↓                                   │
┌────────────┐                            │
│ Processing │ ← Organize and format      │
└─────┬──────┘                            │
      ↓                                   │
┌────────────┐                            │
│ Analysis   │ ← Create intelligence      │
└─────┬──────┘                            │
      ↓                                   │
┌────────────┐                            │
│Dissemination│← Share with consumers     │
└─────┬───────┘                           │
      ↓                                   │
┌────────────┐                            │
│ Feedback   │ ← Was it useful?           │
└─────┴──────────────────────────────────-┘

Key insight: Intelligence is a cycle, not a one-time product. Feedback improves future intelligence.

2) Threat Intelligence Sources

Intelligence comes from many sources:

Internal Sources (your own data):

Incident data:
- IOCs from your incidents
- TTPs observed in attacks
- Adversary infrastructure used against you

Log analysis:
- Failed attacks
- Blocked connections
- Suspicious patterns

Security tools:
- EDR detections
- Firewall blocks
- Email gateway catches

Advantages:
- Directly relevant to your organization
- High confidence (you observed it)
- Context-rich

Disadvantages:
- Reactive (already attacked)
- Limited visibility
- Resource-intensive to analyze

External Sources:

Commercial feeds:
- Recorded Future
- Mandiant
- CrowdStrike
- ThreatConnect
- Quality varies, cost significant

Open source (OSINT):
- VirusTotal
- AlienVault OTX
- Abuse.ch (URLhaus, MalwareBazaar)
- MISP communities
- Free, but quality varies

Government/Industry:
- CISA alerts
- FBI Flash reports
- ISACs (sector-specific)
- CERT advisories
- High quality, limited scope

Sharing communities:
- ISACs (FS-ISAC, H-ISAC, etc.)
- MISP instances
- Threat sharing groups
- Bidirectional sharing

Evaluating Intelligence Quality:

Admiralty Scale (NATO system):

Source Reliability:
A - Completely reliable
B - Usually reliable
C - Fairly reliable
D - Not usually reliable
E - Unreliable
F - Cannot be judged

Information Credibility:
1 - Confirmed by other sources
2 - Probably true
3 - Possibly true
4 - Doubtful
5 - Improbable
6 - Cannot be judged

Example rating: B2
"Usually reliable source, probably true information"

Questions to ask:
- Where did this come from?
- How was it collected?
- Has it been validated?
- Is it current?
- Is it relevant to us?

Key insight: More intelligence isn't better intelligence. Focus on quality, relevance, and actionability.

3) Working with IOCs

Indicators of Compromise are tactical intelligence:

IOC Types:

Network indicators:
- IP addresses
- Domain names
- URLs
- SSL certificate hashes

Host indicators:
- File hashes (MD5, SHA1, SHA256)
- File names/paths
- Registry keys
- Mutex names
- Process names

Email indicators:
- Sender addresses
- Subject lines
- Attachment names/hashes
- Header patterns

Behavioral indicators:
- Command patterns
- Network traffic patterns
- Process relationships

IOC Lifecycle:

IOC Value Over Time:

     Value
       │
High   │  ****
       │ *    *
       │*      ***
Medium │         ***
       │            ***
Low    │               *****
       │__________________________ Time
         Hours  Days  Weeks  Months

Hash: Hours to days (trivial to change)
IP: Days to weeks (easy to change)
Domain: Days to weeks (moderate effort)
TTP: Months to years (hard to change)

Implications:
- IOC feeds require constant updates
- Old IOCs create false positives
- Behavioral detection more durable

IOC Management:

IOC workflow:

1. Receive IOC
   - From feed, report, or incident
   
2. Validate
   - Check reputation services
   - Verify source reliability
   - Test in sandbox if applicable

3. Enrich
   - Add context (campaign, actor, malware)
   - Determine relevance
   - Set confidence level

4. Implement
   - Add to SIEM for alerting
   - Block at perimeter (if high confidence)
   - Search historically (retroactive hunt)

5. Maintain
   - Set expiration date
   - Review and retire old IOCs
   - Track effectiveness

STIX and TAXII:

STIX (Structured Threat Information Expression):
- Standard format for threat intelligence
- JSON-based (STIX 2.x)
- Represents objects and relationships

STIX objects:
- Attack Pattern
- Campaign
- Indicator
- Malware
- Threat Actor
- Tool
- Vulnerability

TAXII (Trusted Automated Exchange):
- Protocol for sharing STIX data
- Client-server model
- Collections and channels

Benefits:
- Automation of intel sharing
- Consistent format across tools
- Machine-readable intelligence

Key insight: IOCs are perishable. Without active management, your IOC database becomes a collection of false positive generators.

4) Applying Intelligence in SOC Operations

Intelligence must be operationalized to have value:

Detection Enhancement:

IOC-based detection:
- Add IOCs to SIEM watchlists
- Block at firewall/proxy
- Alert on email gateway
- Search EDR telemetry

Example SIEM rule:
index=proxy dest_domain IN (watchlist_malicious_domains)
| alert severity=high

Behavioral detection from TTPs:
- Translate techniques to detection rules
- Example: "APT uses encoded PowerShell"
  → Alert on PowerShell -enc parameter

ATT&CK mapping:
- Identify techniques used by relevant threats
- Ensure detection coverage
- Prioritize gaps

Alert Enrichment:

When alert fires, enrich with intelligence:

Automatic enrichment:
- IP/domain reputation lookup
- Hash lookup in threat intel
- Geo-location
- ASN information

Manual enrichment:
- Search threat reports
- Check intel platforms
- Query sharing communities

Enrichment questions:
- Is this IOC in our threat intel?
- What campaign/actor is it associated with?
- What other IOCs are related?
- What's the typical attack chain?

Enriched alert is faster to triage

Threat-Informed Defense:

Prioritize defenses based on intelligence:

1. Identify relevant threats
   - Who targets our industry?
   - What's our threat profile?

2. Understand their TTPs
   - How do they gain access?
   - What do they do post-compromise?

3. Map to ATT&CK
   - Which techniques do they use?
   - What's our detection coverage?

4. Prioritize gaps
   - Focus on techniques used by our threats
   - Not all techniques are equal

Example:
"Threat group targeting our sector uses spearphishing
with macro-enabled documents (T1566.001) and PowerShell
for execution (T1059.001). Priority: Enhance email
filtering and PowerShell logging."

Key insight: The question isn't "what threats exist?" but "what threats are relevant to us, and are we prepared?"

5) Producing Intelligence

SOCs can produce intelligence, not just consume it:

Intelligence from Incidents:

Every incident generates potential intelligence:
- IOCs observed
- TTPs used
- Infrastructure details
- Timing and targeting

Incident → Intelligence workflow:
1. Extract IOCs during investigation
2. Document TTPs observed
3. Analyze patterns across incidents
4. Create finished intelligence
5. Share with community (if appropriate)

Creating Threat Reports:

Internal threat report structure:

1. Executive Summary
   - Key findings
   - Relevance to organization
   - Recommended actions

2. Threat Overview
   - Actor/campaign background
   - Motivation and targets
   - Capabilities

3. Technical Analysis
   - Attack chain
   - TTPs (mapped to ATT&CK)
   - IOCs

4. Detection and Mitigation
   - Detection opportunities
   - Prevention measures
   - Response guidance

5. Appendices
   - Full IOC list
   - YARA rules
   - Detection queries

Intelligence Sharing:

Benefits of sharing:
- Improves community defense
- Builds relationships
- Gets intelligence back
- Strengthens ecosystem

Sharing considerations:
- Sanitize sensitive info
- Get legal/PR approval
- Use TLP (Traffic Light Protocol)

TLP Markings:
TLP:RED - Named recipients only
TLP:AMBER - Limited sharing within org
TLP:AMBER+STRICT - Same, no clients
TLP:GREEN - Peer and partner orgs
TLP:CLEAR - Public

Sharing platforms:
- ISACs
- MISP communities
- Informal peer groups
- Public reports (TLP:CLEAR)

Key insight: Organizations that share intelligence receive more than they give. Contribution builds trust and access.

Real-World Context: Threat Intel in Action

Threat intelligence transforms operations:

Proactive Defense: Intelligence about an active campaign allows defenders to hunt for IOCs, enhance detection, and warn users before attacks arrive—not after.

Faster Triage: When an alert matches known threat intelligence, analysts immediately understand context. "This IP is known APT29 infrastructure" changes the response.

Better Decisions: Strategic intelligence helps leadership prioritize security investments. "Nation-states are targeting our sector" justifies budget differently than generic fear of hackers.

MITRE ATT&CK Integration:

• Threat Groups: ATT&CK documents known groups and their TTPs
• Software: Malware and tools mapped to techniques
• Detection: Data sources for each technique

Key insight: Threat intelligence is a force multiplier. It helps defenders focus limited resources where they matter most.

Guided Lab: Threat Intelligence Analysis

Practice working with real threat intelligence.