Building a Threat Intelligence Program
Threat Intelligence is evidence-based knowledge about existing or emerging threats that informs security decisions. A mature threat intelligence program transforms raw data into actionable insights that improve detection, response, and prevention.
The Intelligence Lifecycle
1. Planning and Direction
Define intelligence requirements:- What threats are most relevant to our industry?
- Which threat actors target organizations like ours?
- What indicators should we prioritize?
2. Collection
Gather data from multiple sources:Open Source Intelligence (OSINT):
- National vulnerability databases (NVD, CVE)
- Threat feeds (AlienVault OTX, Abuse.ch)
- Security blogs and advisories
- Social media monitoring
Technical Intelligence:
- Malware analysis results
- Network traffic indicators
- Honeypot data
- Dark web monitoring
Human Intelligence:
- Industry sharing groups (ISACs)
- Law enforcement relationships
- Vendor threat reports
3. Processing
Transform raw data into structured intelligence:- Normalize indicator formats (STIX/TAXII)
- Enrich with context (geolocation, WHOIS, reputation)
- Correlate across sources
- Remove duplicates and false positives
4. Analysis
Produce actionable intelligence:- Tactical: IOCs for immediate detection (IPs, hashes, domains)
- Operational: TTPs and campaign details for hunting
- Strategic: Threat landscape trends for executive decision-making
5. Dissemination
Distribute intelligence to stakeholders:- SOC analysts: Detection rules and IOC feeds
- Incident responders: Threat actor playbooks
- Executives: Risk briefings and trend reports
- Partners: Shared threat indicators
6. Feedback
Evaluate effectiveness and refine:- Did intelligence lead to detections?
- Were false positive rates acceptable?
- What gaps exist in collection?
TTP Mapping with MITRE ATT&CK
Map observed tactics to the ATT&CK framework:
Initial Access: T1566 (Phishing)
Execution: T1059 (Command and Scripting)
Persistence: T1547 (Boot or Logon Autostart)
Credential Access: T1003 (OS Credential Dumping)
Exfiltration: T1048 (Exfiltration Over Alternative Protocol)
Where SuperClue Fits
SuperClue pulls CVE data from NVD, adds CISA KEV and FIRST EPSS data to CVE findings, enriches IPs from SOC detections through OSINT sources such as Spamhaus and the Tor exit list, and lets you add your own IOCs. It does not attribute findings to threat actors or campaigns.