How can you recognize common cyber threat intelligence products?

2 Operational CTI

Operational CTI is a more detailed analysis of the specific threats, tactics, techniques, and procedures (TTPs) of cyber adversaries, as well as their capabilities, intentions, and infrastructure. Operational CTI is usually aimed at security analysts, incident responders, and threat hunters who need to identify, monitor, and counter cyberattacks. Operational CTI products can include indicators of compromise (IOCs), signatures, profiles, or alerts that provide actionable information to detect and mitigate cyberattacks.

3 Tactical CTI

Tactical CTI is a granular and technical description of the tools, methods, and vulnerabilities used by cyber adversaries in their attacks. Tactical CTI is usually aimed at security engineers, developers, and testers who need to harden, patch, and configure their systems and applications. Tactical CTI products can include code samples, exploits, malware analysis, or advisories that provide technical information to prevent and remediate cyberattacks.

4 Threat feeds

Threat feeds are a type of CTI product that deliver continuous streams of raw or processed data about cyber threats from various sources, such as open source, commercial, or government. Threat feeds can provide different levels of CTI, from strategic to tactical, depending on the quality, relevance, and context of the data. Threat feeds can be consumed by humans or machines, using various formats, such as XML, JSON, or STIX. Threat feeds can help you enrich your CTI analysis, but they also require filtering, validation, and integration to avoid noise and false positives.

5 Threat reports

Threat reports are a type of CTI product that deliver periodic or ad hoc summaries of the findings and conclusions of CTI analysis, based on specific topics, events, or incidents. Threat reports can provide different levels of CTI, from strategic to tactical, depending on the scope, depth, and audience of the analysis. Threat reports can be consumed by humans or machines, using various formats, such as PDF, HTML, or CSV. Threat reports can help you communicate your CTI insights, but they also require interpretation, customization, and dissemination to ensure relevance and value.

6 Threat intelligence platforms

Threat intelligence platforms (TIPs) are a type of CTI product that provide a centralized and integrated solution for collecting, processing, analyzing, and sharing CTI. TIPs can ingest and normalize data from various sources and formats, such as threat feeds, reports, or internal data. TIPs can also perform advanced functions, such as correlation, enrichment, automation, or visualization, to enhance and simplify CTI analysis. TIPs can also enable collaboration and dissemination of CTI across your organization and external partners. TIPs can help you manage and leverage your CTI, but they also require configuration, maintenance, and alignment with your CTI needs and goals.