Cyber Threat Intelligence Fundamentals

Introduction

Cyber Threat Intelligence (CTI) is the practice of collecting, analyzing, and applying information about cyber threats to inform defensive decisions. Effective CTI transforms raw data about attacks, vulnerabilities, and threat actors into actionable intelligence that helps organizations anticipate, prevent, and respond to threats.

This section covers the foundational elements of CTI: the intelligence cycle that structures the process, the STIX/TAXII standards for sharing threat data, essential OSINT tools for threat research, and methodologies for profiling threat actors.

The Intelligence Cycle

The intelligence cycle provides a structured framework for producing actionable threat intelligence. Borrowed from military and national intelligence practices, it ensures that CTI efforts are driven by organizational needs rather than data collection for its own sake.

Each phase of the cycle feeds into the next, creating a continuous improvement loop. Requirements from leadership guide collection priorities, collected data is processed and analyzed, and the resulting intelligence products are disseminated to stakeholders who provide feedback that refines future requirements.

Intelligence Cycle Phases

1. Direction: Define intelligence requirements based on organizational risk profile and strategic priorities
2. Collection: Gather raw data from technical feeds, OSINT sources, dark web monitoring, and human intelligence
3. Processing: Normalize, deduplicate, and structure raw data into a format suitable for analysis
4. Analysis: Apply expertise to transform processed data into assessments, predictions, and recommendations
5. Dissemination: Deliver intelligence products to stakeholders in formats appropriate to their roles and decisions
6. Feedback: Collect stakeholder input on intelligence quality and relevance to refine future cycles

Common Mistake: Many organizations focus on collection and skip analysis. A feed of indicators of compromise (IOCs) without context about who is using them, why, and what it means for your organization is data, not intelligence. The analysis phase is where data becomes actionable.

STIX, TAXII, and Sharing Standards

Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII) are the primary standards for encoding and sharing cyber threat intelligence. Together, they enable automated, machine-readable exchange of threat data between organizations.

STIX defines a data model for representing threat intelligence objects including indicators, malware profiles, attack patterns, threat actors, and their relationships. TAXII provides the transport mechanism, defining how STIX data is communicated between systems through RESTful APIs.

• STIX: JSON-based format for encoding threat intelligence objects and their relationships
• TAXII: Protocol for automated exchange of STIX data between intelligence platforms
• MISP: Open-source threat intelligence platform supporting STIX/TAXII and community-driven intelligence sharing
• OpenCTI: Open-source platform for organizing, storing, and visualizing threat intelligence data

Intelligence sharing amplifies the value of CTI. When organizations share indicators and analysis through ISACs (Information Sharing and Analysis Centers) and other communities, each participant benefits from the collective visibility of the entire group.

OSINT Tools and Platforms

Open-source intelligence tools enable security teams to research threats, investigate incidents, and monitor the external attack surface. Effective use of these tools is a core competency for CTI analysts and incident responders.

Each tool provides a different lens on the threat landscape. Shodan reveals internet-facing infrastructure, VirusTotal provides malware analysis, MISP facilitates community intelligence sharing, and specialized tools like Censys and GreyNoise offer additional perspectives on network activity and scanning behavior.

• Shodan: Search engine for internet-connected devices, revealing exposed services, vulnerabilities, and misconfigurations
• VirusTotal: Multi-engine malware scanning platform with behavioral analysis, community comments, and relationship graphing
• MISP: Open-source threat intelligence platform for sharing, storing, and correlating indicators of compromise
• Censys: Internet-wide scanning platform providing detailed certificate and host information
• GreyNoise: Distinguishes between targeted attacks and internet background noise to reduce alert fatigue

Tool Integration: The power of OSINT tools multiplies when they are integrated. An IP address flagged in MISP can be enriched with Shodan data about exposed services, cross-referenced with VirusTotal for associated malware samples, and checked against GreyNoise to determine if it is a known scanner. This enriched context transforms a single indicator into actionable intelligence.

Threat Actor Profiling

Threat actor profiling builds comprehensive assessments of adversary capabilities, motivations, targets, and operational patterns. Effective profiling helps organizations understand not just what an adversary has done but what they are likely to do next.

Profiles combine technical indicators (malware families, infrastructure patterns, TTPs) with strategic context (geopolitical motivations, organizational structure, historical targeting patterns). This holistic view enables predictive defense—anticipating threats based on adversary behavior patterns rather than waiting for indicators of compromise.

Profile Components

1. Attribution: Assessed country of origin, organizational affiliation, and confidence level
2. Motivation: Espionage, financial gain, disruption, influence, or a combination of objectives
3. Capability: Technical sophistication, resource level, and tool development capacity
4. Target profile: Sectors, geographies, and organization types historically targeted
5. TTPs: Preferred techniques mapped to MITRE ATT&CK for detection rule development

Actionable Profiling: The goal of threat actor profiling is not academic knowledge but operational defense. Each profile element should map directly to a defensive action: targeted sectors inform risk assessments, preferred TTPs drive detection engineering, and infrastructure patterns enable proactive blocking.