Threat Intelligence: How It Works, Types, and Implementation in Modern Organizations

Direction (Planning & Direction)

Defining what needs to be known and why. This begins with key questions called Priority Intelligence Requirements (PIRs): Who might target our organization? What methods would they use? Which assets are most at risk?

• Identify critical assets and the organization's crown jewels
• Define PIRs based on the business risk profile
• Define scope: industry sector, geography, threat types
• Establish the required reporting frequency and format

Collection

Gathering raw data from multiple sources based on established PIRs. The quality of intelligence output depends heavily on the diversity and reliability of sources.

• Open Source Intelligence (OSINT): dark web, hacker forums, pastebin, social media
• Commercial feeds: vendor intelligence such as Recorded Future, Mandiant, CrowdStrike
• Sharing communities: ISACs, MISP, ThreatConnect
• Internal sources: SIEM logs, EDR alerts, historical incident reports
• Human Intelligence (HUMINT): connections with the security community, researcher reports

Processing

Transforming raw data into an analyzable format — normalization, deduplication, correlation, and organizing data from multiple sources in different formats.

• Normalize IoCs from different formats into a standard format (STIX/TAXII)
• Deduplication: eliminate redundant data from multiple feeds
• Validation: verify the reliability and freshness of indicators
• Enrichment: add context (ASN, geolocation, malware family, actor)

Analysis

Interpreting processed data to produce meaningful intelligence — this is the most critical element and the one requiring the most human expertise.

• Correlation: connecting separate indicators into a coherent narrative
• Attribution: identifying likely threat actors based on TTPs
• Relevance assessment: how relevant is this threat to our organization?
• Prediction: based on historical patterns, what attacks are likely incoming?

Dissemination

Delivering intelligence to the right audience, in the right format, at the right time. Great intelligence is wasted if it does not reach those who can act on it.

• Strategic reports for management: quarterly threat trends, risk briefings
• Tactical bulletins for security teams: new TTPs, how to detect them
• Operational alerts for SOC: active campaigns, IoCs for immediate blocking
• Automated feeds to tools: push IoCs to SIEM, firewall, and EDR automatically

Feedback

Evaluating the effectiveness of delivered intelligence and refining the process. Was the intelligence relevant? Was it actionable? Did it result in better detections?

• Review whether provided IoCs generated real detections
• Evaluate whether PIRs are still aligned with business changes
• Calibrate sources: which ones are the most accurate and relevant?
• Iterate and continuously improve the process

Mandiant / APT1 Report (2013) — Exposing a Large-Scale Cyber Espionage Operation

Mandiant published a groundbreaking report publicly identifying APT1 as Unit 61398 of the People's Liberation Army — a group that had stolen hundreds of terabytes of data from dozens of US organizations over many years. The report transformed how the industry views geopolitical cyber threats.

• Deep Threat Intelligence enabled accurate attribution — not simply 'unknown attacker.'
• Publishing TTPs in detail helped thousands of other organizations check whether they were also compromised.
• Impact: significantly raised government and enterprise awareness of APTs as a real and serious threat.

Target Data Breach (US, 2013) — An Internal Intelligence Failure

Target had a sophisticated security solution (FireEye) that detected malware on its systems BEFORE the major breach occurred. Alerts were sent to the security team in Bangalore and forwarded to the US team — but the response came too late. The result: 40 million credit card numbers stolen.

• Having intelligence is not enough — organizations must have clear and rapid response processes.
• Alert fatigue is a real problem: too many alerts without context cause critical ones to be overlooked.
• Intelligence must be directly connected to response playbooks, not just monitoring dashboards.

Ukraine Power Grid Attack (2015–2016) — TI That Protected Other Infrastructure

The Sandworm group's attack on Ukraine's power grid was the first time malware successfully caused large-scale power outages (230,000 homes). In-depth analysis of the BlackEnergy and Industroyer malware by ESET and Dragos produced intelligence that prevented similar attacks in other countries.

• Cross-border Threat Intelligence: research from an incident in one country protects critical infrastructure globally.
• ICS/SCADA security requires specialized threat intelligence that differs from traditional IT.
• YARA rules and IoCs from this incident were used by thousands of critical infrastructure organizations worldwide.

BSSN Indonesia — Building National TI Capability

Indonesia's National Cyber and Crypto Agency (BSSN) is actively building national Threat Intelligence capability through the National Security Operations Center (NSOC) and collaboration with ASEAN CERT. BSSN's 2023 Cyber Report documented 403 million cyber traffic anomalies monitored in Indonesia — data that serves as the basis for early warnings to critical sectors.

• Threat Intelligence at the national level requires coordination between government, private sector, and the security community.
• BSSN provides alerts and advisories that can serve as a free TI source for Indonesian organizations.
• Sharing incident information between organizations — even anonymously — improves the quality of ecosystem-wide intelligence.

Start from Requirements, Not Tools (Month 1)

Before subscribing to any feed, define what you need to know and for whom. Threat Intelligence without direction produces noise, not signal.

• Identify crown jewels: what data is most valuable and most at risk?
• Define PIRs: 'Are there threat actors targeting our industry?', 'What methods are trending for attacks against companies of our size?'
• Inventory available free sources: OSINT, BSSN advisories, vendor blogs, MITRE ATT&CK
• Establish a basic process: who reads intelligence, how is it distributed to the team?

Operationalize Basic IoCs (Months 2–3)

Start integrating Technical Intelligence into existing tools — this delivers immediate value without requiring significant investment.

• Subscribe to free threat feeds: AbuseIPDB, AlienVault OTX, Emerging Threats
• Integrate IoC feeds into existing SIEM or firewall
• Enable threat intelligence features in the EDR solution in use (if available)
• Register domains and brand assets for monitoring with free services (Google Alerts at minimum)

Build Analysis Capability (Months 3–6)

Progress from simply consuming IoCs to deeper analysis more relevant to the organization's context.

• Deploy MISP or OpenCTI as an internal TI platform
• Begin threat hunting based on MITRE ATT&CK TTPs relevant to your sector
• Join relevant ISACs or sharing communities (ID-CERT, BSSN portal)
• Build an internal threat library: document TTPs used in your own historical incidents

Mature & Proactive Program (Month 6+)

A mature TI program produces predictive intelligence — warning of threats before they reach the organization.

• Integrate commercial intelligence feeds for broader coverage
• Conduct intelligence-driven threat modeling: 'If adversary X targeted us, where would they start?'
• Share intelligence with the industry community (contribute, not just consume)
• Measure effectiveness: how much have false positives decreased? How many threats were detected earlier?