In its guide SP 800-150 and the associated glossary, the US institute NIST distinguishes between threat information and threat intelligence. Threat information is any information that helps identify, assess, monitor, and respond to cyber threats. It becomes threat intelligence when it has been aggregated, analyzed, and enriched with context so that it supports decisions. A list of suspicious IP addresses is therefore not yet intelligence; the assessment of which group is currently attacking which industry with which method is.
What types of threat information are there?
NIST names five main types:
- Indicators (IoC): technical traces such as IP addresses, domains, URLs, file hashes, or subject lines of phishing emails.
- Tactics, techniques, and procedures (TTP): how attackers proceed, from the broad goal to the concrete implementation. MITRE ATT&CK offers a common language for this.
- Security alerts: short notices about current vulnerabilities or campaigns, for example from CERTs.
- Threat intelligence reports: detailed analyses of attacker groups, industries, or trends.
- Tool configurations: recommendations and rules for firewalls, filters, or detection systems.
Standards and tools
Open standards exist so that information can be exchanged automatically. STIX 2.1 describes threat information in a uniform format, and TAXII 2.1 governs transmission via HTTPS; both have been OASIS standards since June 2021. The open source platform MISP collects, stores, and shares indicators and is co-funded by the EU. In many sharing groups, how far a piece of information may be passed on is governed by FIRST's Traffic Light Protocol (TLP).
In practice for SMEs and municipalities
Hardly any smaller organization needs its own threat intelligence department. A few well-chosen sources are effective:
- CERT.at, the Austrian national CERT, publishes warnings about serious vulnerabilities and daily reports.
- Vendor advisories on your own products, ideally machine-readable.
- The CISA KEV catalog shows which vulnerabilities are actually being exploited.
- Leak monitoring reports whether credentials from your own domain appear in data leaks.
It is important that every source has a consequence: Who reads the warning, who decides, who acts? Larger environments feed indicators into SIEM and XDR so that they are automatically checked against their own logs.
Risks and typical mistakes
- Data overload: Many freely available feeds deliver large numbers of indicators with no relation to your own operations.
- Outdated indicators: IP addresses and domains change quickly; old lists generate false alarms.
- Missing context: Without knowledge of your own systems, it is impossible to judge whether a warning is relevant.
- Confidentiality disregarded: Information with a TLP label may only be passed on within the agreed group.
How TOMORIS relates
GRID.darkwatch monitors agreed company identifiers in data leaks that have become known, assesses relevant hits, and provides guidance on affected accounts. EXPERTS Cyber Security supports assessment and response in the event of attacks.