Threat intelligence (CTI)
CTI · cyber threat intelligence · threat intel · threat landscape · TLP · Traffic Light Protocol
Information gathered and analysed about attackers (who they are, what they target, how they operate) to guide defence decisions.
In practice
There are three levels: strategic (trends and threats for a sector, useful to leadership), operational (groups’ modus operandi, their tactics and techniques) and technical (indicators of compromise to load into tools). Sources range from public bulletins, such as CERT-FR’s or ENISA’s annual threat landscape, to commercial feeds and sharing communities. The Traffic Light Protocol (TLP) states who a piece of information may be shared with.
Fictional case: a hospital group’s threat watch reports that a ransomware gang is exploiting a VPN flaw against European hospitals. The team checks its own equipment that same day, applies the patch and searches its logs for the published indicators.
