Chapter 9 — Threat intelligence basics | Technical Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Threat intelligence basics

Lesson map

Lesson 09 published. Map, example, EX033.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 What it is"]
  N2["9.2 Indicators and behaviours"]
  N3["9.3 Sources"]
  N4["9.4 Relevance"]
  N5["9.5 Acting on intelligence"]
  N6["9.6 Sharing back"]
  N7["Rating reliability"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX033"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 What it is"]
  N2["9.2 Indicators and behaviours"]
  N3["9.3 Sources"]
  N4["9.4 Relevance"]
  N5["9.5 Acting on intelligence"]
  N6["9.6 Sharing back"]
  N7["Rating reliability"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX033"]

[Learning outcomes]
    |
    v
[9.1 What it is]
    |
    v
[9.2 Indicators and behaviours]
    |
    v
[9.3 Sources]
    |
    v
[9.4 Relevance]
    |
    v
[9.5 Acting on intelligence]
    |
    v
[9.6 Sharing back]
    |
    v
[Rating reliability]
    |
    v
[Worked example] --> [Exercise EX033]

Learning outcomes

You will (1) explain what threat intelligence is; (2) distinguish indicators from behaviours; (3) judge source reliability; (4) use intelligence to guide monitoring.

9.1 What it is

Threat intelligence is information about threats that helps you decide what to do. Useful intelligence is timely, relevant to your organisation and actionable. For Northgate, the sharing group's warning about guessing against council portals met all three tests. It arrived within days of the parks01 case, it concerned exactly the kind of portal the council runs, and it pointed to an action, MFA. A report about mobile banking apps would fail the relevance test for the council. Carlos checks each new report against these three tests before spending time on it.

9.2 Indicators and behaviours

Indicators are specific values such as domains and addresses; they change quickly. Behaviours, described in MITRE ATT&CK, change slowly. The pyramid of pain idea says behaviours are harder for attackers to change. 203.0.113.80 is an indicator; the attacker can switch to another address tomorrow. The behaviour, many failures followed by a success from one source, stays the same whatever address is used. That is why Carlos's new rule detects the behaviour itself rather than simply blocking the single address seen on Monday.

9.3 Sources

Northgate receives a national government alert feed, a local-government sharing group and vendor reports. Each is rated for reliability based on past accuracy. The national feed supplied cdn-files.example, which matched the planning-office PC, and the sharing group supplied the warning about portal guessing. Rating each source helps Carlos decide how far to trust an item. A reliable source's indicator can be searched at once; an unknown one waits for a low-priority check. The ratings are reviewed twice a year from the count of indicators that led to real findings.

9.4 Relevance

A report about attacks on councils' remote-access portals is highly relevant after the parks01 case; a report about a mobile banking app is not. Relevance depends on what Northgate runs and has just experienced. The parks01 case proved the portal was a target, so reports about portal attacks moved up in priority. Reading every report equally would waste the small team's time on threats the council does not face. Relevance is reassessed after each incident, since a new case can make an old report suddenly important.

9.5 Acting on intelligence

The sharing group warns that password guessing against council portals has increased. Aisha asks IT to require multi-factor authentication on the portal for all accounts, including shared ones. This is intelligence turning into a control that IT can actually configure. The warning combined with Northgate's own case justified the cost of MFA, including for shared accounts that were later replaced. The guessing attempt against a councillor's account in the rule's first live month was stopped because MFA had been enabled by then. The MFA change also covered shared accounts until they were replaced with named ones.

9.6 Sharing back

Northgate shares its own anonymised indicators (203.0.113.80 and the invoice domain) with the group. Sharing back is what makes the group useful to everyone. Other councils can search their portal logs for 203.0.113.80 and the invoice domain. Anonymising removes parks01, the finance officer and any details that would identify staff, while keeping the indicators and times that others need. Carlos removes staff names and internal host addresses before anything leaves the council. Aisha approves each item, because sharing is an external disclosure even when anonymised. The sharing group's own handling rules then decide which member councils may see it.

Rating reliability

Northgate rates each source on past accuracy: reliable, usually reliable or unknown. The national feed and sharing group are reliable; a free blog list is unknown and its indicators are used only for low-priority searches, never automatic blocking. Ratings are reviewed twice a year when Carlos and Aisha count how many indicators from each source led to real findings.

Keeping it short

Notes stay to one paragraph so busy managers actually read them.

Worked example

Carlos writes a one-paragraph intelligence note: "Password guessing against council portals rising (sharing group, reliable). Northgate affected 09:04 Monday; parks01 compromised. Recommend MFA on portal; monitor for success after failures; share indicators." Aisha forwards it to the IT manager.

Synthetic case. Feeds and reports are invented.

Errors and limits

Intelligence can be wrong or late; combine it with your own data.

Exercises

EX033 — Useful intelligence. Give three qualities of useful intelligence. Rubric: 3 = timely, relevant, actionable; 2 = two; 1 = one; 0 = none.
EX034 — Indicators vs behaviours. Why focus on behaviours? Rubric: 3 = change slowly; harder for attackers to change; 2 = partial; 1 = vague; 0 = none.
EX035 — Action taken. What action followed the sharing-group warning? Rubric: 3 = MFA on portal for all accounts; 2 = partial; 1 = vague; 0 = none.
EX036 — Sharing back. What did Northgate share? Rubric: 3 = 203.0.113.80 and invoice domain, anonymised; 2 = partial; 1 = vague; 0 = none.

Synthesis

Intelligence guides action when it is relevant and trusted; share back to help others.

Continue studying — chapter 09 of 18

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →