Threat intelligence is often bought before anyone has decided what questions it should answer. The result is a feed of millions of indicators pushed into a firewall or SIEM, a spike in false positives, and very little insight. Good intelligence starts with requirements, and only then with sources and tooling.
Start with intelligence requirements
Write down the decisions intelligence should support. Which threat groups target your sector and region? Which vulnerabilities in your stack are being exploited right now? Are your customers' credentials or your brand being abused? These priority intelligence requirements decide whether you need strategic reporting for leadership, technical indicators for detection, or monitoring of criminal forums and leaked data.
- Strategic intelligence explains who is targeting organizations like yours and why. Its audience is leadership and risk owners.
- Operational and tactical intelligence describes how attackers operate: their tools, techniques and infrastructure, mapped to MITRE ATT&CK. Its audience is detection engineers and threat hunters.
- Technical intelligence is the indicators themselves: IP addresses, domains and file hashes. It ages quickly and is most useful when enriched with context.
Free and community sources
Several free sources deserve a place in every program. The CISA Known Exploited Vulnerabilities catalog is the most useful single list for patch prioritization. The abuse.ch projects, including URLhaus, MalwareBazaar and ThreatFox, publish high-quality malware and infrastructure indicators. Sector ISACs, such as FS-ISAC for financial services, share intelligence between members, and national CERTs in the Gulf publish advisories relevant to the region.
Commercial intelligence providers
| Provider | Known for | Good fit |
|---|---|---|
| Google Threat Intelligence | Mandiant incident response research combined with VirusTotal data and Google visibility | Teams that want deep actor reporting and malware context |
| Recorded Future | Broad collection across open, technical and dark web sources, strong integrations; owned by Mastercard since 2024 | Organizations wanting one intelligence hub for many teams |
| CrowdStrike Counter Adversary Operations | Adversary profiles tied directly to Falcon detections and hunting | CrowdStrike customers |
| Microsoft Defender Threat Intelligence | Internet infrastructure data and actor reporting inside the Microsoft security stack | Microsoft-centric SOCs |
| Intel 471 and Flashpoint | Cybercrime underground, initial access brokers, leaked credentials | Fraud, brand and account takeover use cases |
Threat intelligence platforms
A threat intelligence platform (TIP) collects intelligence from every source, removes duplicates, scores confidence, links indicators to actors and campaigns, and pushes the useful parts to your SIEM, EDR and firewalls. Most use the STIX 2.1 data model and the TAXII protocol to exchange data.
| Platform | Model | Strengths | Watch for |
|---|---|---|---|
| MISP | Open source | The standard for community sharing, huge user base, many ISACs use it | Interface and data model take time to learn |
| OpenCTI | Open source with enterprise edition | STIX 2.1 native, strong knowledge graph, good connectors | Needs infrastructure and care to run at scale |
| ThreatConnect | Commercial | Intelligence operations plus risk quantification and playbooks | Licence cost |
| Anomali ThreatStream | Commercial | Large feed marketplace and integrations | Value depends on the feeds you add |
| EclecticIQ | Commercial | Analyst workflows and support for European and government users | Smaller ecosystem than the largest vendors |
Measuring whether intelligence works
- How many detections, hunts or blocked attacks trace back to a specific intelligence source each quarter?
- How often did intelligence change a patching or architecture decision?
- What share of indicator matches turned out to be true positives? A feed with a high false positive rate costs more than it saves.
- Do leadership briefings lead to decisions, or are they read and filed?
- Threat intelligence
- CTI
- MISP
- OpenCTI
- STIX
- Tool comparison
