Written and maintained by CASRAI Editorial Board
Last updated
Threat intelligence is cyber threat information that has been aggregated, transformed, analyzed, interpreted or enriched so that a defender can act on it. That is the NIST glossary wording for cyber threat intelligence (CTI), attributed there to NIST SP 800-61 Rev. 3 and adapted from NIST SP 800-150 (NIST CSRC glossary, read 2026-11-07). This guide is for security analysts, research-computing and IT staff, and research-security officers who need to know what counts as threat intelligence, how its types differ, where it comes from, how it is shared, and how it connects to detection work.
What qualifies as threat intelligence?
Raw data does not qualify; analyzed and contextualized information does. NIST’s definition turns on the verbs: information that has been aggregated, transformed, analyzed, interpreted, or enriched becomes intelligence. A list of IP addresses pulled from a log is data. The same list after someone has established that the addresses were used in a particular intrusion campaign, how reliable that link is, and what a defender should do about it is threat intelligence.
Three tests separate intelligence from a raw feed:
- Analysis: someone has interpreted the observation, rather than just collecting it.
- Context: it says who or what is behind the activity, what it targets, and how confident the assessment is.
- Actionability: a specific audience can use it to decide something, such as a patch order, a detection rule or a briefing to leadership.
In research settings this matters because universities and labs hold valuable data and run open networks. Threat intelligence is one input to the wider discipline described under research security, and to meeting controls such as those in NIST SP 800-171 and CMMC Level 3.
Types of threat intelligence
Practitioners usually sort threat intelligence by the decision it supports. The strategic, operational and tactical split below is the common convention in industry guidance rather than a single standard.
| Type | Typical audience | What it answers | Typical form |
|---|---|---|---|
| Strategic | Executives, boards, research leadership | Who is likely to target us, and why? | Trend and risk assessments |
| Operational | Incident responders, threat hunters | How are campaigns run, and what is coming? | Campaign and actor reports |
| Tactical | SOC analysts, detection engineers | What does the attack look like on our systems? | Indicators of compromise, detection rules, technique descriptions |
Indicators of compromise (hashes, domains, IP addresses) are the most perishable tactical output, because attackers change infrastructure quickly. Descriptions of adversary behavior last longer, which is why behavior-based frameworks such as MITRE ATT&CK (below) matter.
The intelligence cycle
Most teams describe threat intelligence work as a repeating cycle. A widely used six-step version is:
- Direction: decide what questions matter (for example, which threats target research institutions).
- Collection: gather data from logs, feeds, reports and open sources.
- Processing: normalize, de-duplicate and structure what was collected.
- Analysis: interpret it, assess confidence and add context.
- Dissemination: deliver it to the people who can act, in a usable format.
- Feedback: learn from consumers what was useful and adjust the questions.
The loop matters more than the labels: collection without direction produces volume, not intelligence.
What are 5 examples of threats?
Threat intelligence tracks adversaries and the methods they use. Five common categories are:
- Malware: malicious software such as trojans, loaders and info-stealers. Public sample-sharing services support analysis; see the MalwareBazaar guide.
- Phishing: deceptive messages that steal credentials or deliver malicious attachments or links.
- Ransomware: malware that encrypts or exfiltrates data and demands payment.
- Distributed denial of service (DDoS): traffic floods that make a service unavailable.
- Insider threat: misuse of legitimate access, whether malicious or accidental.
Threats to machine-learning systems have their own catalogue; see the MITRE ATLAS guide.
From reports to detections: MITRE ATT&CK
MITRE describes ATT&CK as a knowledge base of cyber adversary behavior and a taxonomy of adversarial actions across their lifecycle, covering Enterprise and Mobile (MITRE ATT&CK FAQ, read 2026-11-07). Its FAQ states that publicly available threat intelligence and incident reporting is the main source of data in ATT&CK, so the framework is itself a product of the intelligence process.
ATT&CK gives analysts a shared vocabulary built on three layers, which is the practical bridge from a narrative report to a detection:
- Tactics are the adversary’s goal, the “why”.
- Techniques are how the goal is achieved, the “how”.
- Procedures are the specific implementation an adversary uses, documented on technique pages as in-the-wild use under “Procedure Examples”.
Mapping a report to techniques lets a team ask a concrete question: do we have visibility and detection coverage for each technique this actor uses?
Sources and the top OSINT tool categories
Open-source intelligence (OSINT) means information gathered from publicly available sources. There is no authoritative “top 10” list of OSINT tools, and any ranking would be opinion, so this section organizes tools by what they do. Named examples are well-known public services; check each service’s own terms and access rules before use.
| Category | What it helps you find | Examples |
|---|---|---|
| Malware sample repositories | Known malicious files, hashes and family names | MalwareBazaar |
| Threat intelligence platforms | Storing, linking and sharing indicators and reports in structured form | OpenCTI |
| Adversary knowledge bases | Documented behavior of attackers | MITRE ATT&CK, MITRE ATLAS |
Whatever the source, record when it was collected and how reliable it is, because those two attributes decide how far the item can be trusted in analysis.
Feeds, platforms and sharing formats
A threat intelligence feed is a stream of indicators or reports from a provider. A threat intelligence platform (TIP) ingests feeds and internal findings, de-duplicates them, adds context and pushes them to security tools. Open-source platforms such as OpenCTI exist alongside commercial ones; this guide does not rank them.
Sharing depends on common formats. STIX 2.1, an OASIS Standard dated 10 June 2021, is a language and serialization format for exchanging cyber threat intelligence, published by the OASIS Cyber Threat Intelligence Technical Committee. TAXII is its companion specification, “designed specifically to transport STIX Objects”, while STIX itself is transport-agnostic (OASIS STIX 2.1 specification, read 2026-11-07).
How much does it cost to get a CTIA certification?
CTIA stands for Certified Threat Intelligence Analyst, a credential issued by EC-Council. This page does not quote a price: fees are set by the certification body and vary by route (exam only or a bundled training format), so the current figure should be read from EC-Council’s own certification pages. The cost of a certification is separate from the cost of the free and open-source tools above, which need no certification to use.
Frequently asked questions
What is threat intelligence in cyber security?
It is cyber threat information that has been aggregated, transformed, analyzed, interpreted or enriched (NIST CSRC glossary). In practice it describes adversaries, their methods and indicators, so defenders can prioritize and respond.
What is the difference between threat data and threat intelligence?
Data is unprocessed observation, such as an IP address in a log. Intelligence adds analysis, context and a judgment about what to do.
What are the three types of threat intelligence?
Strategic (for leadership decisions), operational (about campaigns and actors) and tactical (indicators and detection details), as laid out in the table above.
Are threat intelligence tools free?
Some are: OpenCTI is an open-source platform, and public services such as MalwareBazaar offer open access. Commercial platforms and feeds exist too; this guide does not compare prices.
How is threat intelligence shared between organizations?
Commonly as STIX objects, transported over TAXII or other channels, and as written reports mapped to ATT&CK techniques.
Sources
- NIST CSRC Glossary, “cyber threat intelligence”: csrc.nist.gov/glossary/term/cyber_threat_intelligence (read 2026-11-07).
- MITRE ATT&CK FAQ: attack.mitre.org/resources/faq (read 2026-11-07).
- OASIS, STIX Version 2.1: docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html (read 2026-11-07).
