Academy
TermThreat intelligence

Threat intelligence

(TI)

Information collected about threats, processed and presented with its context to support decision-making.

Flow

  1. 1Collection
  2. 2Analysis
  3. 3Sharing
Related families
Lumma Stealer
MITRE ATT&CK
—
Sources
3 sources
01

Overview

NIST defines threat intelligence as threat information that has been aggregated, transformed, analysed, interpreted or enriched to provide the context needed for decision-making. NIST CSRC

A raw list of indicators is not intelligence on its own; it gains value once it is known which actor, campaign and target audience it belongs to. NIST CSRC

02

How it works

  1. 1

    Collection

    Open sources, underground channels, telemetry and sharing networks. NIST CSRC

  2. 2

    Analysis

    Information is verified, correlated and prioritised. NIST CSRC

  3. 3

    Sharing

    The result is delivered in a form the relevant team can use. NIST CSRC

03

Real-world examples

04

How to detect it

  • Match intelligence against your own logs to search retroactively. NIST CSRC
05

What to do

  • Set priorities according to the actors and methods that target your sector. NIST CSRC
06

Related families and terms

07

Sources

  1. 1Threat intelligence — glossary definition · NIST CSRC
  2. 2Indicator of compromise — glossary definition · NIST CSRC
  3. 3Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.