Threat intelligence is context about who is likely to target you, what they tend to do, and what that means for your defenses. This is Module 8 of The Complete Blue Team Course.
What Threat Intelligence Is For
Intelligence is not just a feed of indicators to block. Teams that treat it that way get stuck at the bottom of the Pyramid of Pain, blocking atoms like IP addresses and hashes that an attacker can swap out in minutes. Real intelligence tells you where to focus detection effort.
Strategic, Operational, and Tactical Intel
- Strategic: informs leadership decisions about which threats matter to this business.
- Operational: explains how a specific campaign or actor operates.
- Tactical: the technical detail, such as indicators of compromise, used day to day.
Good programs use all three. Immature ones only ever touch the tactical layer.
Making Intel Actionable
Intelligence that does not change a detection, a priority, or a decision was not worth collecting. The test for any program is simple: can you point to a specific detection or decision that exists because of it?
Where to Start
- Read public reports about threats relevant to your industry.
- Map the behaviors described in them to ATT&CK techniques.
- Check whether you can detect each behavior, and write detections for the gaps.
Key Takeaways
- Intel is context, not just indicators.
- Use strategic, operational, and tactical intel together.
- Judge intel by the detections and decisions it changes.
Frequently Asked Questions
What is an IOC?
An indicator of compromise is an artifact such as an IP address, domain, or file hash that suggests malicious activity.
Do small teams need threat intelligence?
Yes, but at a smaller scale: following a few relevant reports and turning them into detections is enough to start.
Get the Full Blue Team Course
This is a free preview of Module 8. The complete 22-module course, from SOC fundamentals and SIEM to threat hunting, incident response, detection engineering, and career paths, is available as a one-time $1 download.