In October 2023, a mid-sized manufacturing company's security operations centre received an automated alert from their SIEM: an IP address had made a connection attempt to an internal server. The IP was not in any commercial threat feed the team subscribed to, and the alert would normally have been triaged as low priority and cleared within 24 hours. An analyst who happened to be working that afternoon ran the IP through their threat intelligence platform before clearing the alert. The IP appeared in a MISP instance the organisation shared with their industry's information sharing community: it had been reported three days earlier as command and control infrastructure for a supply chain attack targeting their sector. The connection attempt was not random scanning; it was the early stage of a targeted intrusion. The detection that prevented the compromise did not come from a commercial threat feed. It came from a shared community threat intelligence platform that provided context the commercial feeds did not have.
Indicators of compromise (IOCs) are the atomic units of threat intelligence: IP addresses, domain names, URL patterns, file hashes, email addresses, and other observable artefacts that are associated with malicious activity. When a security researcher discovers a phishing campaign, they extract the domain names and IP addresses used by the campaign infrastructure. When a malware analyst reverse-engineers a new sample, they identify the file hash, command and control domains, and network indicators that the malware uses. These indicators are published in threat feeds, shared in information sharing communities, and integrated into security tools to enable detection of activity using the same infrastructure or malware.
IOCs have a lifecycle that determines their operational value. A freshly discovered IOC, still actively used by the threat actor who created the associated infrastructure, provides high detection value: a security tool that detects a connection to the IOC's associated IP address is very likely detecting real threat actor activity. As time passes and threat actors rotate their infrastructure (a routine operational security practice for sophisticated actors), the IOC becomes less reliable as an indicator of active threat activity. An IP address that was C2 infrastructure for a ransomware group six months ago may now host a legitimate service, and blocking or alerting on it produces false positives that erode analyst trust in the threat intelligence programme.
The decay rate of IOCs varies significantly by type. IP addresses rotate frequently, sometimes within hours for actors using hosting services and VPN infrastructure that provides easy IP rotation. Domain names persist longer, particularly for actors who have invested in domain age and reputation for their infrastructure. File hashes are effectively permanent indicators for the specific file they represent, but threat actors routinely produce new variants with different hashes to evade signature detection. Managing IOC quality requires tracking the age of each indicator, the source's reliability, and whether the indicator has been observed in recent activity, and reducing the priority or retiring indicators that have aged past their expected validity window.
Threat intelligence platforms (TIPs) manage the IOC lifecycle and provide the infrastructure for sharing, enriching, and operationalising threat intelligence. MISP (Malware Information Sharing Platform), originally developed by the European Union Agency for Cybersecurity (ENISA) and now maintained by an active open-source community, is the most widely deployed open-source TIP. MISP organises indicators into events, which represent discrete threat observations with associated metadata, and provides federation features that allow organisations to share events with trusted partners while controlling what is shared with whom.
OpenCTI, developed by Filigran and backed by ANSSI (the French national cybersecurity agency), takes a knowledge graph approach to threat intelligence, modelling relationships between threat actors, campaigns, malware families, vulnerabilities, attack patterns, and indicators as a connected graph rather than as isolated events. This relational model enables queries that MISP's event-based structure cannot easily support, such as "show me all indicators associated with threat actors that have targeted French financial services organisations in the past 12 months." OpenCTI natively implements the STIX 2.1 data model, making it straightforward to import from and export to any STIX-compliant source.
STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the standards that enable interoperability between threat intelligence platforms. STIX 2.1 defines a JSON-based data model for representing threat intelligence objects: indicators, threat actors, malware instances, attack patterns mapped to MITRE ATT&CK techniques, campaigns, and the relationships between them. TAXII 2.1 defines the API protocol for exchanging STIX content between systems, enabling automated pull and push of threat intelligence between platforms.
The practical value of these standards is interoperability: an indicator published in a STIX-formatted TAXII feed can be automatically ingested by any STIX-compliant platform, enriched with additional context, and pushed to security tools that consume STIX indicators for detection. An organisation that has invested in a STIX-native workflow can pull indicators from multiple sources, including commercial feeds, open-source intelligence, and community sharing, and have them automatically formatted and ready for integration into their SIEM, EDR, and network security tools without manual transformation for each source.
The gap between receiving IOC data and acting on it is where many threat intelligence programmes fail. A threat intelligence team that produces enriched, contextualised indicator reports that are emailed to the SOC as PDFs has built a reporting capability, not an operational intelligence capability. The operational value of IOC intelligence comes from its integration into the detection and response workflow, where indicators are automatically checked against security tool logs, and confirmed matches trigger pre-defined response playbooks without requiring an analyst to manually bridge the gap between the intelligence and the detection.
SOAR (Security Orchestration, Automation, and Response) platforms are the operational layer that connects threat intelligence platforms to detection and response workflows. When a new indicator is added to the TIP with sufficient confidence and freshness, the SOAR platform automatically adds it to blocklists in the firewall and proxy, creates detection rules in the SIEM, and sets up an automated alert that will trigger a pre-defined response workflow if the indicator is observed. This automation removes the manual steps that slow down the operationalisation of threat intelligence and ensures that high-quality indicators are acted on within minutes of being ingested, rather than within hours or days.
Connecting the IOC management layer to dark web and paste site monitoring intelligence creates a feedback loop: indicators discovered in paste site monitoring and dark web surveillance are enriched with context from the TIP, and IOCs from the TIP are used to recognise when a newly discovered piece of data relates to a known threat actor's infrastructure. This integration is what distinguishes a mature threat intelligence programme from an organisation that simply subscribes to commercial indicator feeds and imports them into their SIEM without enrichment or context.
Threat intelligence programmes are notoriously difficult to measure for effectiveness, because their primary value is in preventing incidents that are hard to attribute to specific intelligence actions. A threat intelligence programme that blocks 50 C2 connections per month is generating measurable detections, but an analyst cannot easily determine how many of those blocked connections would have resulted in successful intrusions without the blocking. Measuring what did not happen requires assumptions that are difficult to validate.
Practical metrics for threat intelligence programme effectiveness focus on the operational quality of the intelligence produced rather than on downstream incident prevention. Mean time to indicator operationalisation measures how long it takes for a new indicator to move from ingestion to active blocking or detection in security tools. Feed quality metrics track the false positive rate for each intelligence source, enabling informed decisions about which sources to prioritise and which to deprioritise or retire. Coverage metrics assess whether the intelligence programme covers the threat landscape relevant to the organisation, with gaps in coverage representing monitoring blind spots that should be addressed through additional sources or community participation.
Community participation metrics are particularly relevant for organisations using MISP and information sharing communities. The value of shared threat intelligence communities depends on members contributing as well as consuming; an organisation that only consumes without contributing is extracting value without sustaining the resource. Tracking the volume and quality of indicators contributed to sharing communities and comparing it to the volume and quality received provides a measure of the organisation's contribution to the collective intelligence ecosystem that it benefits from, creating an accountability mechanism that sustains the community's value over time. Defendis integrates with your TIP workflow to provide enriched indicators from dark web sources and paste site monitoring that enhance both your internal intelligence and your ability to contribute meaningful intelligence to your sharing communities.
Information sharing communities organised around threat intelligence are one of the most valuable and underused resources available to security teams. Communities ranging from sector-specific ISACs (Information Sharing and Analysis Centers) to geographic CERTs to platform-specific communities like the MISP community exchange intelligence about active threats, emerging techniques, and confirmed incidents in ways that benefit all members. The collective intelligence produced by these communities often has better coverage of emerging threats than any individual organisation or commercial vendor can achieve, precisely because it aggregates observations from across the community's membership.
The practical barrier for many organisations is the investment required to participate effectively. Passive consumption, subscribing to feeds and receiving intelligence without contributing, is possible in many communities but creates a free-rider dynamic that gradually degrades community quality if too many members adopt this posture. Active participation requires a dedicated team member who has the time to review incoming intelligence, enrich it with local context when relevant, prepare organisational observations for sharing in a way that respects operational and legal constraints, and engage in the community discussion that produces the analytical value that goes beyond raw indicator exchange.
Starting with a single community at the appropriate level (a national CERT, a sector ISAC, or a vendor-operated community matching the organisation's primary technology stack) allows an organisation to build participation skills and processes before expanding to multiple communities. The return on this investment is best understood in terms of the intelligence that the community provides that would be unavailable or significantly delayed through other sources: early warnings about campaigns targeting the organisation's sector or technology stack, context about TTPs that commercial feeds do not capture, and the peer relationships that enable informal intelligence sharing faster than any formal platform can facilitate. These are the advantages that justify the investment in community participation as a complement to commercial threat intelligence services.
Tactical intelligence is the most granular level: specific indicators of compromise (IP addresses, domains, file hashes, malware signatures) that enable detection and blocking of known malicious activity. It has a short lifespan and is primarily consumed by security tools and SOC analysts. Operational intelligence provides context about specific threat actors, campaigns, and TTPs that helps security teams understand how and why adversaries are targeting their sector or organisation. It informs incident response decisions and threat hunting priorities. Strategic intelligence covers the broader threat landscape, geopolitical factors influencing cyber threat activity, and long-term trends that inform security investment and organisational risk decisions. It is primarily consumed by CISOs, security executives, and board audiences. Effective threat intelligence programmes produce and consume all three levels, with different workflows and consumers for each.
More feeds does not equal better coverage; the quality and relevance of feeds matters more than quantity. An organisation that subscribes to 50 generic IP reputation feeds may have worse operational intelligence than one that subscribes to 3-5 high-quality feeds specialised for their sector and threat landscape. The right number of feeds depends on the organisation's threat profile, the diversity of platforms and services being defended, and the operational capacity to manage the alert volume generated. A common starting point is one high-quality commercial feed covering the most relevant threat categories, one or two community-based feeds from sector-relevant ISACs or CERTs, and one specialised feed for specific high-risk categories (dark web credential monitoring, for example). This provides diverse sourcing without creating an alert volume that exceeds the team's processing capacity.
MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world cyberattacks, organised into a framework that covers initial access through impact. In a threat intelligence programme, ATT&CK provides a common language for describing threat actor behaviour that enables comparison across intelligence sources, gap analysis against existing detections, and structured communication about threats between technical and non-technical audiences. Mapping threat actor TTPs to ATT&CK techniques allows security teams to identify which techniques they have detection coverage for and which represent blind spots, informing detection engineering priorities. ATT&CK is also used in threat intelligence sharing via STIX, where ATT&CK technique IDs are referenced in STIX attack-pattern objects, connecting specific incidents and campaigns to the technique taxonomy.
A SOAR (Security Orchestration, Automation, and Response) platform automates the workflow between receiving threat intelligence and acting on it. When a new IOC is ingested and enriched by the TIP, the SOAR platform can automatically check the IOC against historical SIEM logs for past hits, add the IOC to network blocking lists in the firewall and proxy, create a ticket in the ITSM system with the appropriate priority and assignment, and notify relevant stakeholders via the organisation's communication tools. If the IOC is observed in real-time SIEM data, the SOAR platform triggers a pre-defined investigation playbook that guides the analyst through the response steps, automates evidence collection, and tracks time-to-containment metrics. This automation eliminates the manual handoffs between threat intelligence, SIEM, and response tools that create delays and inconsistency in the operationalisation of threat intelligence.
The volume of threat intelligence data available to security teams has grown faster than analytical capacity can scale through headcount. The same IOC feeds that once contained thousands of indicators now contain millions; the same dark web monitoring that once surfaced dozens of relevant posts per week now surfaces hundreds. This scaling problem is driving investment in AI-augmented analysis tools that process and prioritise threat intelligence at machine speed, surface the highest-priority intelligence to human analysts, and automate the operationalisation of high-confidence indicators without requiring analyst involvement.
Large language models (LLMs) applied to threat intelligence analysis can process unstructured intelligence reports, extract indicators and TTP mappings, generate STIX objects from natural language descriptions, and summarise complex threat actor profiles for different audience levels, all significantly faster than manual analysis. The analytical value of these capabilities is highest when they are applied to the portions of the threat intelligence pipeline where structured analytical work adds less value than speed: initial triage of high-volume feeds, extraction of indicators from unstructured reports, and generation of initial brief-level summaries. More complex analytical tasks, like assessing the credibility of a new attribution claim or evaluating whether an intelligence report is a false flag, still benefit from experienced human judgement.
The integration of AI capabilities into threat intelligence platforms is an active development area that will continue to change what is tractable for security teams to process and act on. Organisations that invest now in the foundational infrastructure (a TIP with STIX-native data models, SOAR integration for operationalisation, and clean data pipelines) will be well-positioned to benefit from AI-augmented analysis as these capabilities mature, because the AI tools require structured, well-labelled data to be effective. A threat intelligence programme built on inconsistent data and manual processes is much harder to augment with AI than one with the structured foundation that Defendis provides through its enriched and contextualised intelligence feeds.
A threat intelligence programme that ingests large volumes of low-quality IOCs produces more noise than signal. Each IOC added to a detection system generates potential alerts; each false positive alert consumes analyst time that could be spent on genuine threats. The investment in IOC quality management, curating sources, retiring stale indicators, and calibrating confidence thresholds, produces better security outcomes than maximising feed volume. Defendis applies quality filtering at ingestion, delivering IOCs with confidence and freshness metadata that enables tiered deployment policies matching each indicator's reliability level to the appropriate response posture.
Paste sites and data leak channels publish stolen data continuously. Defendis monitors these sources for mentions of your domains, email patterns, IP ranges, and brand identifiers, alerting your team when your data appears before attackers have time to exploit it. The same intelligence feed enriches IOC context for your security operations, connecting raw indicators to the campaign and threat actor data that makes them actionable. Early detection on paste sites combined with enriched IOC intelligence is what closes the gap between exposure and response.
Request a demo to see how Defendis monitors data leak channels and delivers enriched threat intelligence for your organisation.
