## Operationalizing Intel

Intel is useless if it sits in a PDF. It must "Drive Operations".

### 1. Alert Enrichment (Context)
*   **Without Intel**: SIEM Alert "Connection to 1.2.3.4". Priority: Unknown.
*   **With Intel**: SIEM Alert "Connection to 1.2.3.4 (Known Conti Ransomware Node)". Priority: **CRITICAL**.
*   *How*: Connect your SIEM to a TIP.

### 2. Retroactive Hunting
*   Intel Report: "In Jan 2024, Actor X used `evil.com`."
*   Today is March 2024. Blocking it now helps, but...
*   **Action**: Search your *Historical Logs* (Cold Storage). Did anyone talk to `evil.com` back in January?
    *   If Yes: You have been compromised for 3 months. **Incident Response Start**.

### 3. Vulnerability Prioritization
*   Scanner says: "You have 10,000 unpatched bugs."
*   Intel says: "Only CVE-2023-1234 is being actively exploited in the wild by Ransomware."
*   **Action**: Patch CVE-2023-1234 *tonight*. The rest can wait.

### 4. TTP-Based Defense
*   Intel says: "Lazarus is using LNK files in ZIP Archives."
*   **Action**: Update Email Gateway to block `.lnk` attachments. Update EDR to alert on `cmd.exe` spawned from `explorer.exe` via LNK.