Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the securi

Technical threat intelligence is specifically designed to be consumed by security devices in digital, machine-readable formats. It includes IoCs like malicious IP addresses, domain names, URLs, and file hashes that enable automated blocking and identification of inbound and outbound malicious traffic - exactly matching Roma's described activity.

Operational threat intelligence focuses on the specifics of incoming attacks, including actor TTPs and campaigns, and is used to prepare defensive responses rather than to directly feed automated blocking rules into security devices.

Tactical threat intelligence covers adversary tactics, techniques, and procedures (TTPs) to help security teams understand how attacks are carried out, not to provide machine-readable indicators for automated device enforcement.

Strategic threat intelligence provides high-level, non-technical information about threats and trends intended for executive and board-level decision-making, not for direct consumption by security devices.