3.2 Types of Threat Intelligence

Threat intelligence can be categorized based on its operational and technical implications:

Operation Driven #

Strategic, operational, and tactical relevance, each serving different purposes within an organization or military structure.

Strategic Threat Intelligence #

Focuses on long-term trends, adversary capabilities, and geopolitical motivations. It provides a high-level understanding of the threat landscape and informs policy and strategic planning. For example, understanding a nation-state’s long-term cyber warfare objectives or the evolution of cybercrime syndicates. High-level information intended for senior executives and decision-makers. It focuses on the broader threat landscape, geopolitical factors, adversary motivations, and potential business impacts. Strategic CTI helps organizations understand their overall risk exposure and allocate resources effectively.

Examples: Reports on emerging threat actor groups, analysis of industry- specific threats, assessments of geopolitical risks impacting cybersecurity.

Operational Threat Intelligence #

Provides insights into adversary TTPs, campaigns, and infrastructure. It helps security teams understand how specific threat actors operate and supports defensive and offensive planning. For example, details about a specific phishing campaign targeting a sector or the infrastructure used by an APT group. Information about specific incoming attacks or campaigns. It is highly time-sensitive and actionable, often focusing on specific IoCs. Operational CTI helps security teams detect and respond to active threats.

Examples: IP addresses of malicious servers, malicious domain names, file hashes of known malware, phishing email headers, vulnerability alerts.

Tactical Threat Intelligence #

Delivers immediate, actionable information (e.g., Indicators of Compromise – IOCs like IP addresses, domain names, file hashes) for real-time defense and incident response. This type of intelligence is often consumed by security tools for automated blocking or alerting. More detailed information about adversary tactics, techniques, and procedures (TTPs). It is intended for security professionals (e.g., SOC analysts, incident responders) to help them identify and mitigate specific threats. Tactical CTI focuses on how adversaries operate.

Examples: Descriptions of malware families, analysis of specific attack campaigns, details on adversary infrastructure (e.g., C2 servers, exploit kits), MITRE ATT&CK® framework mappings.

Technology Driven #