Lesson 12 of 15 · 3 min read

Threat Intelligence Platforms, Sharing and Evidence Provenance

Free lessonReviewed 12 November 2026By the AISecurityInterviews editorial team

Reading position

In this lesson

TL;DR: Threat intelligence turns observations into hypotheses and defensive decisions. Preserve source, confidence, time and sharing restrictions, then test relevance against local evidence before blocking or attributing an incident.

Before you read

Pick an answer before you read further. The lesson below explains it, and guessing first, right or wrong, helps the explanation stay with you.

1An IP address appears in a feed. Is every local connection to it malicious?

Observables are not verdicts

An observable is a fact such as a domain, file hash or network address. An indicator adds an interpretation about its security significance. A campaign or actor assessment adds further analysis. Keep those layers separate so that a later correction can change the interpretation without erasing the original observation.

A useful intelligence record includes source, first and last observation, confidence, relevant behavior and distribution restrictions. It also needs a review or expiration rule. A domain that was relevant last year can change ownership. Copying an expired indicator into a permanent blocklist can disrupt legitimate business without improving security.

MISP documentation covers structured threat-information sharing and its supporting formats and taxonomies. MISP warninglists provide context for potentially benign or shared infrastructure. A warninglist match is not proof that an observable is harmless; it is a reason to interpret the evidence carefully.

OpenCTI connectors import, enrich and export threat knowledge, including STIX 2.1 bundles. Connector credentials and distribution settings form a data boundary. An enrichment service can receive sensitive internal observables, and an export can spread material beyond its permitted audience. Review those flows before enabling synchronization.

SECURITY OPERATIONS

Turn intelligence into a local decision

Source

Observation and marking

keep origin

Curate

Confidence and expiry

test theory

Correlate

Relevant local evidence

authorize impact

Act

Bounded rule or response

Boundary checks

Source

Sharing restriction

Preserve markings across connectors.

Act

Correction path

Retract stale or disproven interpretations.

1/4

Source

Observation and marking

A feed match alone does not establish compromise or actor attribution.

Commercial intelligence roles, checked November 2026

Google Threat Intelligence documentation connects its intelligence workflows with VirusTotal search and related analysis. Use intelligence to enrich a case while retaining the supporting source and local evidence. It does not replace your organization's logs or establish that a file ran on your endpoint.

SpyCloud's public session-identity documentation describes identifying exposed authentication cookies associated with applications. That supports identity-exposure response: determine whether the artifact is relevant, invalidate affected sessions through the application's actual mechanism and investigate the associated endpoint or account. Password rotation alone must not be assumed to terminate every session.

A fictional shared-hosting indicator

A feed flags an address used by a hosting provider. Your proxy records a connection to that address from a development workstation. Before blocking the whole range, examine the destination hostname, time, process and approved workflow. If the activity is an expected dependency download, the shared address is insufficient evidence of compromise. If it accompanies unexpected process and credential activity, retain the combined evidence and escalate.

Record both outcomes in the intelligence system. Local sightings and disproven matches improve future triage only when they preserve their scope. Avoid turning one clean connection into a universal allowlist entry.

The output defenders need

Produce a hypothesis, the sources that support it, the collection needed to test it and a bounded response recommendation. Keep actor attribution provisional when the evidence supports only a technique or infrastructure overlap. Continue with threat hunting, retrohunting and intelligence into defenses.

Check yourself

Say or write your answer first, then reveal. Explaining it from memory, in your own words, is the skill an interviewer is checking.

1Why preserve distribution markings?
2What should an expired indicator do?

Practise it as an interviewer asks it

Detection Engineering & Incident ResponseHow do you use MITRE ATT&CK to measure detection coverage, and how can a coverage heatmap mislead you?How LLM Systems WorkWhat is MITRE ATLAS, how does it relate to ATT&CK, and how would you map an incident to it?Detection Engineering & Incident ResponseWhat is threat hunting, how do you run a hunt, and how do you know it was worth the time?Detection Engineering & Incident ResponseHow do you triage a suspicious file safely, and how would you write a YARA rule that catches its family without false positives?Detection Engineering & Incident ResponseA threat report describes a group targeting your industry. How do you turn it into defences that actually change?Detection Engineering & Incident ResponseSome malware now asks an AI model what to do at run time. What is real so far, and how should detection and response change?

Course lessons that teach this

Build Security Operations From Events to ResponseCurate threat intelligence before enforcement30 min