Cyber Threat Intelligence (CTI)

CTI starts as threat information, which is any information about a threat that might help an organization protect itself or detect an actor's activities. The main types of threat information are indicators, tactics, techniques, and procedures (TTPs), security alerts, threat intelligence reports, and tool configurations. TTPs describe the behavior of an actor. Threat intelligence reports are prose documents that describe TTPs, actors, the types of systems and information being targeted, and other threat-related information.

Threat information comes from public and private sharing communities, government repositories, commercial threat information feeds, open sources, and the organization's own operations. Some uses are operational, such as updating security controls with new indicators and configurations to detect the latest attacks. Others are strategic, such as using threat information as input when planning major changes to the security architecture.

NIST incident response guidance treats CTI as useful for learning about new threats, improving the accuracy of detection and response technologies, and understanding the TTPs attackers use. Organizations can receive CTI from automated feeds and information sharing forums, and the guidance recommends using current CTI in log analysis and adverse event analysis to improve detection accuracy.

Sharing threat information allows one organization's detection to become another's prevention. Communities organized around an industry or sector benefit in particular, because their members often face actors that use common TTPs against the same types of systems. Sharing also has costs. Trust relationships take effort to establish and maintain, and adopting standard data formats and protocols for automated exchange can require significant time and resources.