Hello and welcome!  Threat intelligence processes can enhance an organisation’s ability to proactively understand and respond to potential security threats, sometimes before they even become an incident. The process can vary hugely, here are some of the key steps in building your own threat intelligence capability.

Define requirements and know your scope.  Requirements are the high-level intentionsof the threat intelligence process. This could include to understand emerging threats or enriching the incident response process as examples.  Requirements keep the process on the right track so that it does not deviate and waste resource over time.

Scope is more about the depth to go, as there is a lot of data in any organisation, limiting scope makes it easier for the team to handle the process without becoming overwhelmed and lost. The scope can be specific systems, assets, or applications that will be covered by the threat intelligence process. This can also consider excluded items too, again to avoid complexity.

Data Sources. Threat data sources can vary massively, this can be a combination of internal data sources like security logging, incident response reports and penetration test reports.  External Data Sources can include commercial threat data feeds, open-source intelligence feeds, industry-specific information sharing groups, and law enforcement groups. Be specific to avoid being overwhelmed with data.

Analysis.  An agreed process to collect, aggregate, threat data from both internal and external data sources is needed too. This may involve leveraging security information and event management (SIEM) solutions, even a dedicated threat intelligence platform if there is budget for commercial solutions.  The process to analyse the collected threat data, is to look for trends, patterns, and highlight potential threats. Its possible to use automation, keyword searches, artificial intelligence, or manual analysis techniques to extract intelligence from the threat data.

Threat intelligence operations.  Integrate the threat intelligence process and output, with existing security operations, incident response, and red team activities. Communication and consistency are key, ensuring relevant threat intelligence is shared and used to enhance incident detection and response, and mitigation strategies.  Integration can be manual or automated, through regular meetings or integration of output into security operations tools.

Risk Prioritisation and actionable intelligence.  Develop or use existing risk assessment frameworks within the organisation to prioritise threats based on their potential impact, likelihood of occurrence, and relevance to the organisation.  Always make sure the information shared is actionable, consistent sharing of information that is of no use can dramatically reduce the credibility of threat intelligence in an organisation.

Monitoring, consistency, don’t give up!  Establish mechanisms for two-way communication, information sharing between the threat intelligence process and other security teams.  Never dismiss input from other teams wanting to contribute to threat intelligence. Encourage collaboration and communication to ensure that threat intelligence remains relevant and of use in a business setting.

Be consistent with delivery and do not give up as this area of security is not understood by everyone and because of this adoption and contributions can be an early challenge.

I hope this has been useful, thank you for reading!