Threat intelligence is evidence-based knowledge about existing or emerging cyber threats, including the actors behind them, their motivations, and the tactics, techniques, and procedures they use, refined into a form that supports security decisions. It turns raw data about attacks into context an organization can act on.
Analysts usually sort it into three levels. Strategic intelligence informs executives about long-term risk trends, operational intelligence describes specific campaigns and adversary behavior, and tactical intelligence delivers the indicators of compromise, such as malicious IP addresses and file hashes, that feed detection tools. A SOC might pull a feed of known bad domains straight into its firewall or SIEM. The common failure is drowning in feeds: buying more indicators than the team can validate produces noise and alert fatigue, not safety. Intelligence also ages quickly, so a stale indicator can be worse than none. Good programs prioritize what is relevant to their own industry and infrastructure, and they measure whether it actually changes a decision.
How is threat intelligence tested on the CISSP?
It sits in Domain 7, Security Operations. Candidates should recognize the strategic, operational, and tactical tiers, understand indicators of compromise, and connect intelligence to detection, incident response, and the intelligence lifecycle.