Threat Intelligence

Cyber Threat Intelligence, or threat intelligence for short, is the process of collecting and analyzing information about cyber threats to understand their motives, targets, and attack behaviors. The goal is to turn this raw data into actionable insights that help organizations make faster, more informed security decisions and shift from a reactive to a proactive defense posture.

There are three main types, each serving a different purpose:

Strategic intelligence: A high-level view of the threat landscape used by executives (CISOs, CIOs) to inform long-term security strategy, investments, and risk management.

Operational intelligence: Details on the "how" and "why" of specific attacks, including adversaries' tactics, techniques, and procedures (TTPs). This is used by SOC managers and incident responders to shape defensive plans.

Tactical intelligence: Specific, technical indicators of compromise (IoCs) like malicious IP addresses, domains, or file hashes. Security analysts use this for real-time threat detection and blocking.

Threat intelligence is essential for a modern SOC because it provides the necessary context to prioritize threats. Faced with an overwhelming volume of alerts, Corelight Threat Intelligence helps analysts focus on genuine threats, reduce false positives, and better understand the nature of an attack, leading to faster, more effective incident response.

Corelight Threat Intelligence uses a curated set of high-confidence indicators and tailored alerting logic to generate better alerts. This increases detection accuracy while reducing false positives and alert noise compared to using unfiltered or less-tuned threat intelligence feeds.

Threat hunters can run queries on Corelight’s historical network evidence using contextual IOCs updated hourly to identify vulnerable systems and threats that have gone undetected for months or even years.