What is Cyber Threat Intelligence (CTI)?
Cyber Threat Intelligence (CTI) is the discipline of collecting, processing, and analyzing data to understand a threat actor's motives, targets, and attack behaviors. Unlike basic data collection, intelligence provides context, enabling organizations to move from a reactive security posture to a proactive one.
In modern Security Operations Centers (SOC), CTI answers three critical questions:
- Who is attacking us? (Attribution)
- Why are they doing it? (Motivation)
- What will they do next? (Prediction)
The Three Levels of Intelligence
CTI is generally categorized into three levels, each serving a different audience within an organization. To be effective, intelligence must be tailored to the consumer.
1. Strategic Intelligence
- Audience: C-Suite, Board of Directors, CISOs.
- Focus: High-level trends, financial impact, and geopolitical risks.
- Example: A report detailing how geopolitical tension in Eastern Europe may increase cyber espionage activities against the energy sector.
- Goal: To inform long-term business decisions and budget allocation.
2. Operational Intelligence
- Audience: Security Managers, Threat Hunters, Incident Response (IR) leads.
- Focus: Adversary campaigns, TTPs (Tactics, Techniques, and Procedures), and intent.
- Example: Intelligence regarding the "Fancy Bear" group utilizing a specific zero-day vulnerability in VPN concentrators.
- Goal: To guide proactive threat hunting and patch prioritization.
3. Tactical Intelligence
- Audience: SOC Analysts, SIEM Administrators, Firewall Admins.
- Focus: Technical indicators such as IP addresses, file hashes, and domains—collectively known as Indicators of Compromise (IOCs).
- Example: A list of malicious IP addresses associated with a Cobalt Strike beacon.
- Goal: To implement automated blocking rules in firewalls and EDR systems.
Why CTI is Critical
Organizations that rely solely on automated alerts are often overwhelmed by false positives. By integrating the Intelligence Cycle, teams can filter out noise and focus on threats that are relevant to their specific industry and technology stack.