Overview
Threat intelligence comes in tactical, operational, and strategic types, each serving different consumers. This lesson covers them.
Learning objectives
- Distinguish tactical, operational, and strategic intelligence.
- Explain who consumes each and how.
- Connect the types to SOC use.
Core concept
Threat intelligence is often categorized by level of abstraction and audience: Tactical — the most granular, technical intelligence: IOCs (IPs, domains, hashes, URLs) and specific attack details, used by SOC analysts and tools for immediate detection (often short-lived). Operational — intelligence about adversary campaigns, techniques, tactics, and procedures (TTPs): how attackers operate, used to improve detection and response over the medium term (more durable than tactical IOCs). Strategic — high-level, big-picture intelligence about the threat landscape, adversary motivations, and trends, used by leadership for risk and resource decisions (long-term, non-technical). Each type serves a different consumer and purpose; a mature program produces all three, matching intelligence to the decisions it informs.
How it works
The three types differ in granularity, durability, and audience. Tactical intelligence is concrete and technical — the IOCs and specific artifacts (from module 7) fed into SIEM/IDS/EDR for immediate, automated detection; it's often short-lived (attackers rotate IPs/domains fast) and consumed by analysts and tools. Operational intelligence describes how adversaries operate — their TTPs (tactics, techniques, procedures), campaigns, and behaviors (often mapped to frameworks describing attacker techniques); it's more durable than IOCs (behaviors change more slowly than infrastructure) and helps the SOC build behavior-based detections and anticipate attacker methods. Strategic intelligence is the big picture — the evolving threat landscape, which adversaries target the organization/industry and why, and broad trends; it's long-term and mostly non-technical, consumed by leadership to guide risk decisions, priorities, and resource allocation. Matching intelligence to audience is key: leadership needs strategic context, not raw IOCs; analysts need tactical indicators and operational TTPs, not just high-level trends. A mature program produces and disseminates all three appropriately (tying to the lifecycle's dissemination stage), so intelligence informs decisions at every level — from a firewall block (tactical) to a security-investment decision (strategic).
Practical example
A SOC uses all three intelligence types. Tactical: a feed provides IOCs (malicious IPs/domains/hashes) that are loaded into the SIEM and IDS for immediate detection — but rotate quickly. Operational: analysis of an adversary's TTPs (how a relevant threat actor typically operates — its techniques and procedures) guides the SOC in building behavior-based detections and hunting for those methods — more durable than the IOCs. Strategic: a briefing to leadership summarizes the threat landscape for the organization's industry and which adversaries pose the greatest risk, informing security investment decisions. Each type reached the right consumer for the right decision — tactical for detection, operational for detection strategy, strategic for leadership — showing why the SOC produces all three.
Cybersecurity relevance
The three intelligence types match intelligence to consumers and decisions: tactical (IOCs, immediate detection by analysts/tools — module 7, often short-lived), operational (adversary TTPs/campaigns, durable behavior-based detection and anticipation), and strategic (threat-landscape big picture for leadership risk/resource decisions). Understanding them ensures intelligence is used well — leadership gets strategic context, analysts get tactical/operational detail — rather than mismatched to the audience. It connects tactical intelligence directly to IOC analysis and operational intelligence to behavior-based detection and threat hunting (module 16). A mature program produces all three (via the lifecycle), so threat intelligence informs SOC decisions at every level, from an immediate block to strategic security planning.
Common mistakes
- Treating all intelligence as tactical IOCs, ignoring durable operational TTPs and strategic context.
- Mismatching intelligence to audience (raw IOCs to leadership, or only high-level trends to analysts).
- Over-relying on short-lived tactical IOCs without building behavior-based (operational) detection.
Key takeaways
- Tactical intelligence = IOCs and technical details for immediate detection (analysts/tools, often short-lived).
- Operational intelligence = adversary TTPs/campaigns (how they operate) for durable behavior-based detection and anticipation.
- Strategic intelligence = threat-landscape big picture and trends for leadership risk/resource decisions (long-term, non-technical); a mature program produces all three, matched to audience.
Check your understanding
- How do tactical, operational, and strategic intelligence differ in granularity, durability, and audience?
- Why does matching intelligence type to consumer matter?