Threat intelligence is supposed to make your security program proactive. Most organizations use it reactively: they subscribe to a threat feed, ingest a few thousand IOCs into their SIEM or firewall, and block some known-bad IP addresses. That is IOC blocking, not threat intelligence. Real CTI changes how you detect, prioritize, and respond. This guide covers the full spectrum — from operationalizing IOCs to building a TTP-based detection program.
The Four Types of Threat Intelligence
Not all threat intelligence serves the same purpose. Understanding the hierarchy prevents misalignment between what you buy and what your team can actually use:
- Strategic: High-level analysis of threat actor motivations, geopolitical factors, and industry targeting trends. Audience: CISO, board, executives. Frequency: monthly or quarterly briefings. Output: informs budget and program priorities.
- Operational: Information about specific planned or ongoing campaigns. Attacker objectives, targeted industries, and infrastructure being used. Audience: SOC managers and IR teams. Frequency: weekly. Output: hunting priorities and defensive posture adjustments.
- Tactical: TTPs (Tactics, Techniques, and Procedures) used by specific threat actors. How they move laterally, what tools they deploy, what detection gaps they exploit. Audience: detection engineers and threat hunters. Frequency: continuous. Output: new detection rules and hunting queries.
- Technical: IOCs — IP addresses, domains, file hashes, URLs, email addresses. Audience: SIEM, EDR, firewall. Frequency: daily or real-time feeds. Output: automated blocking and alerting.
The prioritization trap: Most organizations over-invest in technical intelligence (IOC feeds) and under-invest in tactical intelligence (TTPs). IOCs expire in hours to days as attackers rotate infrastructure. TTPs persist across campaigns for months to years. Invest accordingly.
Indicators of Compromise (IOCs): What They Are and What They Are Not
IOCs are forensic artifacts suggesting a system may be compromised: malicious IP addresses and domains, file hashes of known-malicious binaries, registry keys and file paths associated with specific malware families, and YARA signatures matching code patterns. They are the lowest form of intelligence because they are trivially changed by threat actors — a new C2 IP or a recompiled binary produces a different hash. Use IOC feeds for automated blocking at the perimeter and SIEM correlation, but do not measure your threat intelligence program’s maturity by the number of IOCs you ingest.
Free IOC sources worth using
- AlienVault OTX — Largest open threat intelligence community, 19 million+ threat indicators
- MISP — Open-source threat intelligence platform for sharing and consuming IOCs within trusted communities
- CISA Known Exploited Vulnerabilities (KEV) catalog — Authoritative list of vulnerabilities actively exploited in the wild
- Abuse.ch Threat Feeds — Real-time botnet C2, malware URLs, and SSL certificate indicators
MITRE ATT&CK: The Framework That Changes How You Detect
MITRE ATT&CK is a knowledge base of adversary behaviors documented from real-world intrusions. It maps techniques to 14 tactics (the attacker’s objective at each stage) and provides sub-technique detail, detection recommendations, and references to threat actor groups that use each technique. It is the closest thing the security industry has to a shared language for attacker behavior.
The framework’s value is not in reading it — it is in using it to identify detection gaps. Compare your current SIEM rules and EDR detections against the techniques used by threat actors targeting your industry. Where you have no coverage is where attackers will move undetected.
Use the ATT&CK Navigator to visualize your coverage. Color each technique green (detected and alerted), yellow (logged but not alerted), or red (no coverage). The red cells are your hunting backlog.
Common gap: Most organizations have good coverage of Initial Access and Execution techniques (the initial compromise). Coverage drops sharply for Defense Evasion, Lateral Movement, and Collection — the techniques used after the attacker is inside. Attackers know this and exploit it.
Building a CTI Program: The Minimum Viable Version
A CTI program does not require a dedicated team of analysts. A single motivated analyst with the right tooling can deliver significant value:
- Week 1: Subscribe to three free IOC feeds (OTX, Abuse.ch, CISA KEV). Integrate with your SIEM for automated IOC matching. Establish a weekly threat intelligence digest for the security team.
- Week 2: Run an ATT&CK Navigator assessment. Identify the five highest-gap techniques for your industry. Write one new SIEM detection rule per week targeting uncovered techniques.
- Month 2: Join an industry ISAC (Information Sharing and Analysis Center) for your sector. ISACs provide sector-specific intelligence you cannot get from commercial feeds: targeted campaigns against your industry, early warning of new TTPs, and direct analyst-to-analyst sharing.
- Month 3: Build a threat actor profile for the three groups most active against your sector. Document their TTPs, preferred tools, and indicators. Use this profile to drive quarterly threat hunting missions.
Threat Hunting: Putting Intelligence to Use
Threat hunting is the active, hypothesis-driven search for threats that bypassed your automated detections. Intelligence drives the hypothesis: “Group X is known to use Cobalt Strike with a specific beacon profile. Do we see any network traffic matching that profile in our environment?”
A basic threat hunt follows three steps: formulate the hypothesis from intelligence, collect the relevant data (endpoint logs, network captures, DNS queries), and analyze for anomalies. Document every hunt — whether you find something or not. Negative results refine your baseline. Positive results generate new detections that close the gap permanently.
Takeaway: Start with MITRE ATT&CK Navigator to map your detection coverage. Fill the highest-risk gaps with new SIEM rules before buying commercial threat intelligence. Subscribe to the VigilSecureInfo newsletter for weekly threat intelligence summaries and emerging TTP coverage.
🔗 Further Reading
Frequently Asked Questions
What is cyber threat intelligence (CTI)?
Cyber threat intelligence (CTI) is evidence-based knowledge about existing or emerging threats to an organization's assets, including context, mechanisms, indicators, implications, and actionable recommendations. CTI operates at four levels: strategic (high-level trends for executives), operational (specific campaigns and threat actor activity), tactical (TTPs for detection engineers), and technical (IOCs for automated blocking). The goal is converting raw data about threats into decisions that improve security posture.
What is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It organizes attacker behavior into 14 tactics (the attacker's objective at each stage) with hundreds of techniques and sub-techniques. Security teams use ATT&CK to identify detection gaps, guide threat hunting, build detection rules mapped to real attack behavior, and communicate threats in a common language. The ATT&CK Navigator tool helps visualize coverage.
What are Indicators of Compromise (IOCs)?
Indicators of Compromise (IOCs) are forensic artifacts that suggest a system may have been compromised. Common IOC types include: IP addresses associated with C2 infrastructure, malicious domain names, file hashes (MD5, SHA-256) of known malware, registry keys created by malware, file paths and names used by threat actors, and network traffic signatures. IOCs are the most immediately actionable but least durable form of threat intelligence — attackers rotate IOCs frequently, making TTP-based detection more robust.
What is threat hunting?
Threat hunting is the proactive, hypothesis-driven search for threats that have bypassed automated security controls. Unlike reactive alert investigation, threat hunting assumes threats are already present and uses threat intelligence, behavioral analysis, and anomaly detection to find them. A hunt begins with a hypothesis ("APT29 uses Cobalt Strike with a specific beacon profile"), collects relevant data, and analyzes for matches. Successful hunts produce new detection rules that close the identified gap permanently.
