Threat intelligence is the *set of activities and resources available to cybersecurity professionals seeking to learn about changes in the threat environment*. *Building a threat intelligence program* is a crucial part of any organisation's approach to cybersecurity. If you're not familiar with current threats, you won't be able to build appropriate defences to protect your organisation against those threats. Threat intelligence information can also be used for *predictive analysis to identify likely risks* to the organisation. **Threat feeds** are intended to provide up-to-date detail about threats in a way that your organisation can leverage. Threat feeds often include technical details about threats, such as IP addresses, hostnames and domains, email addresses, URLs, file hashes, file paths, CVE numbers, and other details about a threat. **Vulnerability databases** are also an essential part of an organisation's threat intelligence program. Reports of vulnerabilities certainly help direct an organisation's defensive efforts, but they also provide valuable insight into the types of exploit being discovered by researchers. Threat intelligence sources may also provide [[Indicators of Compromise]] (IoCs). These are the *telltale signs that an attack has taken place* and may include file signatures, log patterns, and other evidence left behind by attackers. IoCs may also be found in file and code repositories that offer threat intelligence information. Organisations can improve their detection capabilities by staying updated on the evolving threat landscape and understanding the relationship between their environment and malicious actors. One way to understand threats is by using **threat intelligence**, which is evidence-based threat information that provides context about existing or emerging threats. Threat intelligence can come from private or public sources like: - *Industry reports*: These often include details about attacker's **tactics, techniques, and procedures** (TTP). - *Government advisories*: Similar to industry reports, government advisories include details about attackers' TTP. - *Threat data feeds*: Threat data feeds provide a stream of threat-related data that can be used to help protect against sophisticated attackers like advanced persistent threats ([[Advanced Persistent Threats|APTs]]). The data is usually a list of indicators like *IP addresses*, *domains, and file hashes*. It can be difficult for organisations to efficiently manage large volumes of threat intelligence. Organisations can leverage a *threat intelligence platform* (**TIP**) which is an application that collects, centralises, and analyses threat intelligence from different sources. TIPs provide a centralised platform for organisations to identify and prioritise relevant threats and improve their security posture.