Threat Intelligence: How Defenders Learn to Think Like Attackers

The 30-second explanation

It's a neighbourhood watch bulletin for the internet: what kinds of break-ins are happening nearby, how they're being pulled off, and what to lock first.

How it works

1. 1

   1. Collect

   Gather reports, feeds and firsthand observations.

2. 2

   2. Analyse

   Check how reliable the source is and add usable context.

3. 3

   3. Share

   Get it to the people who can act on it.

4. 4

   4. Act

   Search for it, block it, or use it to improve a detection.

Raw information about attacks is everywhere: lists of bad websites, write-ups of how a campaign worked, notes traded between defenders. Left on its own, it's just noise. Threat intelligence is what that information becomes once someone checks it, adds context, and works out why it matters to you specifically. The question behind every good piece of it is the same: what should we do differently because of this? Some sits at a high level, like which attackers currently take an interest in your industry. Some is much narrower: a website address or file fingerprint worth searching your own logs for right now.

Real-world example

How to spot it

• Stale indicators

  A domain or file hash the attacker abandoned months ago has little value now.

• Weak sourcing

  A claim with no explanation of how it was verified deserves less confidence.

• No matching detection

  Intelligence that never turns into a search, a block, or a rule doesn't actually help anyone.

• No fit to your environment

  A finding that doesn't map to anything you actually run isn't worth acting on yet.

What to do

1. 1Ask what changed because of a piece of intelligence; if the answer is nothing, it wasn't actionable.
2. 2Prioritise behaviours over one-off indicators, since behaviours stay useful for far longer.
3. 3Retire indicators once they've expired instead of letting stale data quietly pile up.