Threat intelligence
Context that changes a decision. IoCs expire. TTPs last. A feed you never action is a newsletter.
Tactical intel is indicators. Operational intel is how a set of actors works this quarter. Strategic intel is what the board should fund.
Good intel answers: are we a plausible target, would we see this, what should we change this week.
ACSC alerts, CISA KEV, and vendor advisories are intel if you turn them into tickets. Otherwise they are tab hoarding.
