Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the…

Technical threat intelligence consists of actionable data such as IP addresses, domains, URLs, and file hashes that are directly fed into security tools like firewalls, IDS/IPS, and SIEMs. This allows automated systems to detect and prevent threats in real-time by blocking known malicious indicators of compromise (IoCs).

Operational threat intelligence focuses on the 'how' of an attack, providing details on attacker methodologies, tools, and infrastructure, which is used for incident response and threat hunting, not direct device configuration.

Tactical threat intelligence describes specific attack vectors and techniques (TTPs) used by threat actors, helping security teams understand attack patterns and improve defensive postures, rather than providing direct IoCs for devices.

Strategic threat intelligence provides high-level information about the global threat landscape, actor motivations, and geopolitical factors, which is used for executive decision-making and risk management, not for direct operational security device feeds.