What is threat intelligence?

Threat intelligence is information about attackers and their methods that helps you defend yourself: known malicious addresses and domains, file fingerprints, descriptions of active campaigns and which industries they target. It comes from security vendors, national CSIRTs, industry groups and public feeds. It is most useful when it is current and relevant to you; a list of a million old addresses mostly produces noise. For a small company, the practical form is usually built into the tools you already have, plus alerts from your national CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. about vulnerabilities being exploited. It complements, but does not replace, watching your own network.

← All 69 questions on What is…? Network and security termsAll topics