## Types of Threat Intelligence

Not all intelligence is created equal. We categorize CTI into three (sometimes four) main types based on the **Consumer** (who reads it) and the **Horizon** (how long it matters).

---

### 1. Strategic Intelligence
*   **Audience**: Executives, Board of Directors, CISO.
*   **Focus**: High-level trends, financial risk, brand reputation, and geopolitics.
*   **Time Horizon**: Long-term (Years).
*   **Example Content**:
    *   "Ransomware attacks in our industry increased by 200% this quarter."
    *   "New regulations in the EU will impact our data privacy compliance."
    *   "The conflict in Region X increases the risk of nation-state cyber retaliation."
*   **Goal**: To inform business decisions, budget allocation, and risk management. **No technical terms.**

### 2. Operational Intelligence
*   **Audience**: Security Managers, Threat Hunters, Incident Responders.
*   **Focus**: **TTPs** (Tactics, Techniques, and Procedures). The "How" and "Why" of an attack.
*   **Time Horizon**: Mid-term (Weeks to Months).
*   **Example Content**:
    *   "APT29 is using a new technique to bypass Multi-Factor Authentication (MFA)."
    *   "The 'Emotet' botnet sends phishing emails with subject lines regarding invoices."
    *   "Adversaries are actively exploiting the PrintNightmare vulnerability."
*   **Goal**: To update security posture, prioritize patching, and guide threat hunting.

### 3. Tactical Intelligence
*   **Audience**: SOC Analysts, SIEM Administrators, Automated Systems (Firewalls).
*   **Focus**: **IOCs** (Indicators of Compromise). The specific artifacts left behind.
*   **Time Horizon**: Short-term (Hours to Days).
*   **Example Content**:
    *   **IP Addresses**: `104.22.1.1`
    *   **File Hashes**: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
    *   **Domains**: `evil-phishing-site.com`
*   **Goal**: Immediate detection and blocking. Tactical intel is often automated because it expires quickly (attackers change IPs cheaply).

---

### Comparison Table

| Feature | Strategic | Operational | Tactical |
| :--- | :--- | :--- | :--- |
| **Consumer** | C-Suite / Board | SOC Mgr / Hunters | Analysts / Machines |
| **Content** | Trends / Risk | TTPs / Campaigns | IOCs (Artifacts) |
| **Lifespan** | Years | Weeks/Months | Hours/Days |
| **Volume** | Low | Medium | High |
| **Automated?** | Never | Rarely | Often |

---

### The "Fourth" Type: Technical Intelligence
Some frameworks include a 4th type focused purely on technical tools and malware analysis results (e.g., "This malware uses XOR encryption with key 0x55"). This often blends into Operational/Tactical.

### Scenario: The Ransomware Attack
*   **Tactical**: The Firewall blocks 10 IPs associated with the C2 server.
*   **Operational**: The Threat Hunter looks for the "Double Pulsar" exploit tool because they know this group uses it.
*   **Strategic**: The CISO presents a report to the Board requesting $2M for offline backups because reliance on cloud sync is a strategic weakness against this specific threat actor.

All three types work together to protect the organization.