Threat intelligence and analysis
External Threat Intelligence
External threat intelligence is knowledge about attackers, their infrastructure and their methods gathered from sources outside an organisation's own network, used to anticipate and detect threats before or as they arrive.
Sources
- Open sources: domain registration data, certificate transparency logs, passive DNS, public malware and phishing repositories, vendor research.
- Shared sources: sector information-sharing groups and government advisories.
- Commercial feeds: curated indicators and reporting sold by vendors.
- Closed sources: criminal forums and markets, observed directly or through a provider.
From data to intelligence
A list of malicious domains is data. Intelligence is that data evaluated against what the organisation actually needs to know: which of these touch our brand, our customers or our suppliers, and what should we do differently as a result. The step in between is analysis, and it is the step most often skipped when a feed is simply plugged into a blocklist.
Where it meets brand protection
Brand protection is external threat intelligence with a narrow question: what on the public internet is pretending to be us or attacking our customers? The sources are the same. The difference is that the output is not a report but a queue of things to remove, each with the evidence a provider needs.
Related terms
Sources
- NIST CSRC glossary: cyber threat intelligence
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.