2.4. Threat Intelligence and Threat Hunting

💡 First Principle: Threat intelligence transforms raw data about attacks into actionable knowledge about who is targeting you, how they operate, and what indicators to look for — but only when the intelligence is timely, relevant, and accurate enough to act on.

Knowing that "nation-state actors use spear-phishing" is interesting. Knowing that a specific APT group targeting your industry is currently using a specific phishing lure with a specific attachment hash — and you can block that hash and train users on that lure right now — is intelligence. The difference is specificity and operationalizability.

The CySA+ exam tests both the sources of threat intelligence and the concepts of threat hunting — two related but distinct activities that both require understanding adversary behavior. Intelligence informs hunting hypotheses; hunting validates or refutes those hypotheses against your own environment.

⚠️ Common Misconception: Threat intelligence feeds are automatically accurate and current. In practice, feed quality varies enormously — stale indicators cause false positives, noisy feeds cause alert fatigue, and irrelevant intel (focused on sectors or geographies unlike your own) wastes analyst time. Evaluating confidence levels is as important as consuming the intel itself.