## What is Cyber Threat Intelligence?

**Cyber Threat Intelligence (CTI)** is evidence-based knowledge, including context, mechanisms, indicators, implications, and action-oriented advice about an existing or emerging menace or hazard to assets.

In simpler terms: **CTI is the art of knowing your enemy.**

It transforms raw data into a narrative that helps you make better security decisions. It answers questions like:
*   "Who is attacking us?"
*   "Why are they attacking us?"
*   "How do they get in?"
*   "What are they after?"

---

### The Pyramid of Value
To understand CTI, you must understand the difference between Data, Information, and Intelligence.

#### 1. Data (The Raw Material)
Data is simple, raw indicators. It has no context.
*   **Example**: `IP Address: 192.168.1.5` or `Hash: a1b2c3d4...`
*   **Value**: Low. Seeing an IP address tells you nothing about *why* it is there or if it is bad.

#### 2. Information (Processed)
Information is data that has been aggregated or enriched. It answers "What is this?"
*   **Example**: "The IP `192.168.1.5` belongs to a known VPN provider and was seen scanning port 445 on our firewall."
*   **Value**: Medium. You know what it is, but not if it's a targeted threat.

#### 3. Intelligence (Actionable Insight)
Intelligence is the analysis of information to provide specific direction. It answers "What should we do?"
*   **Example**: "APT29 is actively using the VPN IP `192.168.1.5` to exploit the Log4j vulnerability in financial institutions to deploy Cobalt Strike. **Recommendation**: Block this IP and patch Log4j immediately."
*   **Value**: High. This captures the intent, the capability, and the necessary action.

> 💡 **Key Takeaway**: If you cannot act on it, it is not intelligence; it is just news.

---

### Why Do We Need CTI?
Many organizations operate in a functional "Firefighting" mode—reacting to alerts as they happen. CTI shifts this to a **Proactive** stance.

#### 1. Proactive Defense (The "Hunt")
Instead of waiting for the SIEM to beep, CTI tells us what to look for. If we know a specific ransomware group uses "RDP Brute Force" followed by "PsExec", we can go *look* for those signs before the ransomware is deployed.

#### 2. Decision Advantage
Security budgets are finite. CTI helps leaders decide where to spend money.
*   *Without CTI*: "We need to fix everything." (Impossible).
*   *With CTI*: "Our threat landscape is dominated by Phishing and Ransomware. We should invest 80% of our budget in Email Security and Offline Backups, and less on physical security."

#### 3. Alert Triage
A SOC Analyst sees 1,000 alerts a day. Which one matters?
CTI provides the context. An alert for "Powershell Execution" might be normal for a SysAdmin. But CTI tells us: "This specific Powershell command matches the exact syntax used by the Emotet Trojan." Suddenly, that alert becomes Priority 1.

---

### Case Study: The Target Breach (2013)
One of the most famous examples of failed intelligence.
*   **The Attack**: Hackers compromised a third-party HVAC vendor just to get into Target's network.
*   **The Warning**: FireEye (security vendor) detected the malware and flagged it.
*   **The Failure**: Target's security team saw the alert but ignored it because they lacked the **Strategic Intelligence** to understand that retail was being aggressively targeted by POS (Point of Sale) RAM scrapers.
*   **The Result**: 40 million credit cards stolen. CEO fired.
*   **Lesson**: Detection tools are not enough. You need the intelligence to understand the *severity* and *context* of what you are seeing.

---

### Summary
*   **Data** is raw numbers. **Information** is context. **Intelligence** is actionable advice.
*   CTI moves you from **Reactive** (Firefighting) to **Proactive** (Hunting).
*   The goal is to reduce risk and speed up response times.