Threat Intelligence · 4 min
What Is Threat Intelligence?
Turning raw data into decisions someone can act on
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Data, information, intelligence
These three words get used interchangeably, and that confusion is why so many threat intel programs stall.
- Data — raw observations: an IP, a hash, a log line
- Information — data with structure and meaning attached
- Intelligence — analyzed information that supports a specific decision
Four common levels
The same event can be described at different altitudes, for different audiences. None of them is the 'real' one.
- Strategic — risk and trends, for executives
- Operational — campaigns and intent, for security leadership
- Tactical — attacker behaviors, for detection and hunting
- Technical — atomic artifacts, for tooling and blocking
Loading the interactive lesson…