2.4.2. Intelligence Sources and Confidence Levels
💡 First Principle: The value of threat intelligence degrades quickly — an IP address used for C2 last week may be an innocent CDN server today. Timeliness, relevancy, and accuracy must be evaluated before acting on any piece of intelligence.
Intelligence Collection Sources:
Open Source Intelligence (OSINT):
- Social media — Threat actor forums, hacktivist announcements, breach claims
- Blogs and forums — Security researcher disclosures, threat actor communications, dark web monitoring
- Government bulletins — CISA advisories, FBI PIN reports, NSA cybersecurity advisories
- CERT/CSIRT feeds — Computer Emergency Response Teams publish IoCs and threat summaries
- Deep/dark web — Credential markets, ransomware group leak sites, exploit sales — monitored via specialized tools
Closed Source Intelligence:
- Paid threat intel feeds — Commercial providers (CrowdStrike, Recorded Future, Mandiant) offering curated, high-confidence IoCs and threat actor profiles
- Information sharing organizations — ISACs (Information Sharing and Analysis Centers) — sector-specific sharing (FS-ISAC for finance, H-ISAC for healthcare). Members share threat intel under trust frameworks.
- Internal sources — Your own SIEM logs, past incident data, honeypot captures — often the highest-relevancy source because it's specific to your environment
Evaluating Intelligence Confidence:
| Dimension | What It Means | Poor Example | Good Example |
|---|---|---|---|
| Timeliness | How recent is it? | IoC from 18 months ago | IoC from active campaign this week |
| Relevancy | Does it apply to your environment/sector? | APT targeting aerospace (you're retail) | Ransomware group targeting retail orgs your size |
| Accuracy | How verified is it? | Single anonymous forum post | Corroborated by three independent sources + CISA advisory |
A report's confidence rating (low / medium / high) describes the quality and corroboration of the sources behind a finding: HIGH means strong evidence from multiple reliable, independent sources with little ambiguity. It is not a probability that you will be attacked, not a guarantee that the recommended countermeasures will work, and does not require government verification.
Acting on a confidence rating. Scale the response to the confidence, which reflects source quality and corroboration rather than how severe the threat would be. High confidence can justify immediate defensive changes. Moderate (medium) confidence justifies proportionate steps, such as heightened monitoring for the actor's known TTPs and a check that existing controls cover them, rather than either an emergency lockdown or waiting for certainty. Low confidence is a lead to corroborate.
Intelligence by Consumer Level:
Threat intelligence is also categorized by who consumes it and how they act on it. The same campaign produces all three views simultaneously:
| Type | Audience | Time Horizon | Example |
|---|---|---|---|
| Strategic | Executives, board, CISO | Long-term (months–years) | "Nation-state groups are increasingly targeting our sector's supply chain" — drives budget and risk-appetite decisions |
| Operational | SOC managers, threat hunters | Medium-term (weeks–months) | "Group TA505 is running an active phishing campaign against financial firms this quarter" — shapes hunt priorities and defensive posture |
| Tactical | SOC analysts, detection engineers | Immediate | Specific IoCs and TTPs (file hashes, C2 IPs, ATT&CK techniques) — fed directly into detection rules and blocklists |
The distinction is audience and time horizon, not source: one report can yield tactical IoCs for the analyst, an operational campaign picture for the SOC, and a strategic trend for leadership.
Threat Intelligence Sharing — Intelligence flows in multiple directions across security functions:
- IR teams consume intel to scope active incidents and identify attacker tools
- Vulnerability management uses intel to prioritize patching (is this CVE being actively exploited?)
- Risk management incorporates threat actor targeting patterns into risk assessments
- Security engineering uses intel to tune detection rules and update security architecture
- Detection and monitoring ingests IoC feeds directly into SIEM block/alert lists
⚠️ Exam Trap: Threat intelligence sharing creates legal and reputational considerations. Organizations sharing threat intelligence must ensure they aren't sharing sensitive internal data (network topology, employee information) along with IoCs. ISACs and formal sharing frameworks (like TAXII/STIX protocols) provide structured sharing that strips sensitive context.
Threat-Intelligence Platforms
A threat-intelligence platform (TIP) collects indicators from many sources, enriches and correlates them, and pushes them to detection tools. Three open platforms appear on CS0-004:
| Platform | Hosting | What it is best at |
|---|---|---|
| Open Threat Exchange (OTX) (LevelBlue, formerly AlienVault) | Free hosted community | Researchers publish pulses (collections of indicators with context); users look up IPs, domains, and hashes, follow contributors, and sync pulses through the DirectConnect API |
| MISP (Malware Information Sharing Platform) | Open source, self-hosted | Storing IoCs in a structured way, automatic correlation with past events, synchronizing with partner MISP instances in trust groups, exporting to IDS and SIEM formats including STIX |
| OpenCTI (Filigran) | Open source, self-deployed | A knowledge graph built on the STIX 2.1 data model that relates actors, campaigns, malware, and observables, fed by connectors to external sources |
Choose by constraint: with no infrastructure, a hosted community such as OTX; for sharing within an ISAC or partner group, MISP; for modeling how threats relate to one another, OpenCTI. Whatever the platform, the confidence tests above (timeliness, relevancy, accuracy) still apply to every indicator it delivers.
⚠️ Exam Trap: STIX and TAXII are standards, not platforms. STIX describes intelligence, TAXII transports it, and platforms such as MISP and OpenCTI produce and consume it.
Reflection Question: Your SIEM has been auto-blocking outbound connections to IPs from a commercial threat intel feed. You discover the feed hasn't been updated in 6 months and contains 40,000 entries, many of which are now legitimate hosting providers. Which confidence dimension has failed, and what is the specific operational risk this creates?
