A feed with a million indicators is not intelligence. Intelligence is knowing which ten of them concern you this week, and what to do about each one.
Three levels, three readers
Strategic. Who attacks your sector, why, and how that is changing. It is read by management and shapes the budget.
Operational. Active campaigns and the methods behind them: how the attacker gets in, moves and stays. It is read by the security team and shapes the defences.
Tactical. Indicators of compromise: addresses, domains, file hashes. They are read by machines and shape the block lists.
A subscription that delivers only the third level gives you work, not knowledge.
Why indicators age
An attacker changes an address in hours and a file hash with every rebuild. The way they work changes far more slowly, because it took them months to learn.
| What you know | How long it stays useful |
|---|---|
| A file hash | Until the next rebuild |
| An address or a domain | Hours to days |
| The tools in use | Weeks to months |
| The methods | Months to years |
That is why an indicator needs an expiry date. A block list that only grows ends up stopping your own partners.
From an indicator to an action
- Delivery. Indicators arrive in the SIEM, the firewall and the EDR automatically. Nothing is copied by hand.
- Context. Each one says which campaign it belongs to and how reliable it is.
- Expiry. Stale indicators are retired on their own.
- Feedback. A detection on your side goes back to the analysts and sharpens the next report.
If any step is missing, the feed turns into noise and the team learns to ignore it.
Four questions for a provider
- Where do the indicators come from: your own observation or a resold feed?
- How much time passes between an observation and its delivery?
- What happens when an indicator is wrong?
- Can I talk to an analyst during an incident?
Global feeds are wide, but they see best where they have sensors. A campaign aimed at one sector in one region is often missing from them, and that is the campaign that matters to you.
Where to start
Start with what is yours. Watch your own domain and brand: look-alike domains, fake pages, leaked employee accounts. This costs little and gives a result in the first week. Add a sector feed when the team is ready to act on it.
Threat Intelligence delivers all three levels, and an analyst stays on the line. A subscription includes help with connecting it to your tools.
