2.4.2. Intelligence Sources and Confidence Levels
💡 First Principle: The value of threat intelligence degrades quickly — an IP address used for C2 last week may be an innocent CDN server today. Timeliness, relevancy, and accuracy must be evaluated before acting on any piece of intelligence.
Intelligence Collection Sources:
Open Source Intelligence (OSINT):
- Social media — Threat actor forums, hacktivist announcements, breach claims
- Blogs and forums — Security researcher disclosures, threat actor communications, dark web monitoring
- Government bulletins — CISA advisories, FBI PIN reports, NSA cybersecurity advisories
- CERT/CSIRT feeds — Computer Emergency Response Teams publish IoCs and threat summaries
- Deep/dark web — Credential markets, ransomware group leak sites, exploit sales — monitored via specialized tools
Closed Source Intelligence:
- Paid threat intel feeds — Commercial providers (CrowdStrike, Recorded Future, Mandiant) offering curated, high-confidence IoCs and threat actor profiles
- Information sharing organizations — ISACs (Information Sharing and Analysis Centers) — sector-specific sharing (FS-ISAC for finance, H-ISAC for healthcare). Members share threat intel under trust frameworks.
- Internal sources — Your own SIEM logs, past incident data, honeypot captures — often the highest-relevancy source because it's specific to your environment
Evaluating Intelligence Confidence:
| Dimension | What It Means | Poor Example | Good Example |
|---|---|---|---|
| Timeliness | How recent is it? | IoC from 18 months ago | IoC from active campaign this week |
| Relevancy | Does it apply to your environment/sector? | APT targeting aerospace (you're retail) | Ransomware group targeting retail orgs your size |
| Accuracy | How verified is it? | Single anonymous forum post | Corroborated by three independent sources + CISA advisory |
Intelligence by Consumer Level:
Threat intelligence is also categorized by who consumes it and how they act on it. The same campaign produces all three views simultaneously:
| Type | Audience | Time Horizon | Example |
|---|---|---|---|
| Strategic | Executives, board, CISO | Long-term (months–years) | "Nation-state groups are increasingly targeting our sector's supply chain" — drives budget and risk-appetite decisions |
| Operational | SOC managers, threat hunters | Medium-term (weeks–months) | "Group TA505 is running an active phishing campaign against financial firms this quarter" — shapes hunt priorities and defensive posture |
| Tactical | SOC analysts, detection engineers | Immediate | Specific IoCs and TTPs (file hashes, C2 IPs, ATT&CK techniques) — fed directly into detection rules and blocklists |
The distinction is audience and time horizon, not source: one report can yield tactical IoCs for the analyst, an operational campaign picture for the SOC, and a strategic trend for leadership.
Threat Intelligence Sharing — Intelligence flows in multiple directions across security functions:
- IR teams consume intel to scope active incidents and identify attacker tools
- Vulnerability management uses intel to prioritize patching (is this CVE being actively exploited?)
- Risk management incorporates threat actor targeting patterns into risk assessments
- Security engineering uses intel to tune detection rules and update security architecture
- Detection and monitoring ingests IoC feeds directly into SIEM block/alert lists
⚠️ Exam Trap: Threat intelligence sharing creates legal and reputational considerations. Organizations sharing threat intelligence must ensure they aren't sharing sensitive internal data (network topology, employee information) along with IoCs. ISACs and formal sharing frameworks (like TAXII/STIX protocols) provide structured sharing that strips sensitive context.
Reflection Question: Your SIEM has been auto-blocking outbound connections to IPs from a commercial threat intel feed. You discover the feed hasn't been updated in 6 months and contains 40,000 entries, many of which are now legitimate hosting providers. Which confidence dimension has failed, and what is the specific operational risk this creates?
