Cyber Threat Intelligence (CTI)

Data is a raw, unprocessed observation (a log line, a hash). Information is data organized into context. Intelligence is information analyzed against a specific requirement to produce an assessment a decision-maker can act on.

A threat is a potential cause of harm (an actor or event); a vulnerability is a weakness that could be exploited; risk is the likelihood and impact of a threat exploiting a vulnerability against a specific asset.

An observable artifact — hash, IP, domain, mutex, registry key — that suggests a system has already been compromised.

A behavior-based signal that an attack is in progress or imminent, independent of any specific static artifact — for example, "process X spawns process Y, then makes an outbound connection."

The "how" of an adversary. Tactics are the goal (e.g., persistence); techniques are the method (e.g., scheduled task); procedures are the specific implementation a given actor uses.

A threat actor is an individual or group conducting malicious activity. A threat group is a tracked cluster of activity attributed, with varying confidence, to a common actor. A campaign is a bounded set of operations sharing goals, timeframe, or infrastructure.

The repeatable production process — Direction, Collection, Processing, Analysis & Production, Dissemination, and Feedback — that turns a stakeholder question into a usable product.

The specific, stakeholder-defined questions that drive what a CTI team collects and analyzes, e.g. "Is our sector being targeted by ransomware affiliates this quarter?"

High-level, non-technical intelligence for executives — trends, geopolitical drivers, and business risk — usually with a long time horizon.

Intelligence about specific campaigns or planned operations, used to anticipate and prepare for a particular threat.

Actor TTPs and behavior patterns used to build detections and inform hunting — the analyst- and engineer-facing layer.

The most granular layer: raw IOCs, malware samples, and infrastructure data, often machine-consumable and the fastest to go stale.

A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, organized as a matrix (Enterprise, Mobile, ICS) and used as the common language for describing behavior.

An ATT&CK-style knowledge base specifically for adversarial threats against AI and machine-learning systems.

A seven-stage intrusion model — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives — used to identify where a defense can break the attack.

A model that represents every intrusion event as four connected vertices — Adversary, Infrastructure, Capability, and Victim — used to pivot between known facts and discover new ones.

A knowledge graph of defensive techniques mapped to the offensive techniques they counter, complementing ATT&CK from the defender's side.

David Bianco's model ranking indicator types by how much cost it imposes on an adversary to change them when detected — trivial (hash values) at the bottom, painful (TTPs) at the top.

STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence as structured data. TAXII (Trusted Automated Exchange of Intelligence Information) is the transport protocol used to share it between platforms.

A labeling scheme — RED, AMBER, AMBER+STRICT, GREEN, CLEAR — that tells a recipient how widely a piece of intelligence may be shared.

A common vocabulary for describing security incidents consistently, enabling data-driven incident analysis such as the annual Verizon Data Breach Investigations Report.

Intelligence derived from publicly available sources: news, social media, forums, code repositories, certificate transparency logs, and more.

Adjacent intelligence disciplines — Human, Signals, Geospatial, and Technical intelligence — that CTI sometimes draws on or parallels in tradecraft.

Collection from restricted-access forums, marketplaces, and Telegram/Discord channels where criminal actors trade access, tools, and stolen data.

Structured streams of indicators or reports, from open-source (abuse.ch, ThreatFox), commercial (vendor feeds), or community (ISAC/ISAO) sources.

A historical record of DNS resolutions over time, used to pivot from a known-bad domain to related infrastructure without directly querying the adversary's systems.

Deliberately vulnerable systems or networks deployed to attract, observe, and collect intelligence on attacker behavior.

Automated dynamic analysis — detonating a sample in an isolated environment — as a collection source for behavioral IOCs and TTPs.

SIEM, EDR, firewall, and proxy logs from your own environment — often the most relevant and highest-fidelity CTI source for your specific organization.

A family of formal methods — Analysis of Competing Hypotheses, Key Assumptions Check, Red Team analysis — used to counter cognitive bias and improve analytic rigor.

A technique that evaluates all plausible explanations against the evidence simultaneously, rather than trying to confirm a single favored hypothesis.

The foundational doctrine of intelligence analysis, including the use of consistent "words of estimative probability" to express confidence without false precision.

Standardized language — "almost certainly," "likely," "roughly even chance," "unlikely" — that maps qualitative confidence to a consistent probability range across a team.

A separate axis from probability: confidence reflects the quality, reliability, and corroboration of the underlying sourcing, not the likelihood of the conclusion itself.

A standardized two-part rating — source reliability A–F, information credibility 1–6 — used to grade raw reporting before it's used in analysis.

Following relationships between entities — domains, IPs, certificates, WHOIS registrants, malware hashes — to expand a single indicator into a broader picture of adversary infrastructure.

The process, and inherent difficulty, of tying an intrusion to a specific actor or sponsor. Usually expressed with an explicit confidence level, since false flags and shared tooling make certainty rare.

Systematic errors in judgment — confirmation bias, mirror-imaging, anchoring — that structured techniques and peer review are designed to catch.

A sophisticated, typically state-sponsored or state-aligned actor conducting stealthy, long-term intrusions with defined strategic objectives.

Different vendors track — and name — the same underlying activity differently: Mandiant (APTxx / UNCxxxx), CrowdStrike (animal + adjective, e.g. "Fancy Bear"), Microsoft (weather names, e.g. "Midnight Blizzard"), MITRE ATT&CK (Gxxxx group IDs).

A criminal business model where ransomware developers lease their malware and infrastructure to "affiliates," who conduct the actual intrusions and split the profits.

A specialized criminal actor who breaches organizations and then sells that access to other threat actors — often ransomware affiliates — rather than exploiting it directly.

Politically or ideologically motivated cyber activity — defacement, DDoS, leaks — aimed at making a statement rather than direct financial gain.

Risk originating from someone with legitimate access — malicious, negligent, or compromised — rather than an external adversary.

Refined, analyzed intelligence output ready for a consumer, as opposed to raw data — spans flash/tactical alerts, actor profiles, and long-form strategic assessments.

A finished-intelligence product consolidating everything known about a tracked group — TTPs, targeting, tooling, and history — as a reference for analysts and detection engineers.

Adding context — first/last seen, confidence, related campaigns, TLP marking — to raw indicators so downstream consumers can prioritize and act on them.

Software used to aggregate, correlate, enrich, and disseminate threat intelligence — e.g. MISP, OpenCTI, ThreatConnect, Anomali.

Information Sharing and Analysis Center/Organization — sector-specific (e.g. FS-ISAC for finance) or cross-sector communities for sharing threat intelligence among trusted peers.

The discipline of adjusting the same underlying finding for different audiences — an executive summary versus a SOC-facing technical bulletin.

The workflow of translating an adversary behavior into a written detection, commonly expressed in Sigma (generic), YARA (file/memory pattern matching), or Snort/Suricata (network) formats.

The point where CTI's tactical output — a TTP, a new IOC set — becomes an engineering backlog item with defined telemetry requirements and validation criteria.

A falsifiable statement — "if actor X is present, telemetry Y should show Z" — derived from CTI, used to proactively search for compromise that automated detections may have missed.

Deliberately reproducing a specific tracked actor's TTPs — via tools like Atomic Red Team or MITRE Caldera — to validate whether existing detections actually fire.

Plotting your organization's detections against the ATT&CK matrix to visualize gaps and prioritize new detection engineering work.

A collaborative exercise where red team (attack) and blue team (defense) work together in real time to validate and improve detection coverage, rather than operating as adversarial, siloed exercises.

An open-source threat intelligence platform for storing, correlating, and sharing IOCs and threat data, including "galaxies" of actor and malware taxonomy.

An open-source platform for structuring, storing, and visualizing threat intelligence knowledge as a connected graph, with native STIX2 support.

A multi-engine scanning and enrichment service for files, URLs, domains, and IPs, widely used for first-pass indicator triage.

Internet-wide scanning search engines used to discover exposed services, adversary infrastructure, and misconfigured assets.

A link-analysis and visualization tool for graphing relationships between entities during infrastructure pivoting and OSINT investigations.

A pattern-matching tool for identifying and classifying malware samples based on textual or binary signatures.

A web tool for visualizing, annotating, and comparing coverage across the ATT&CK matrix — for example, an actor's known techniques versus your detections.

Entry-level roles often focus on indicator triage and enrichment (tactical/technical); senior roles move toward actor tracking, campaign analysis, and strategic reporting.

Options include GCTI (SANS/GIAC Cyber Threat Intelligence) and CTIA (EC-Council), plus broader analyst certifications like GCFA or OSCP for adjacent skill depth.

Start with the intelligence cycle and ATT&CK, practice indicator pivoting and OSINT, learn a structured analytic technique, then build toward actor tracking and finished-intelligence writing.

CTI collection must stay within authorized scope and applicable law — accessing systems without authorization, even for "research," is illegal regardless of intent.