Which type of threat intelligence helps security teams add indicators to defensive systems such as IDS, IPS, firewalls, and endpoints to detect attacks early?

Which type of threat intelligence helps security teams add indicators to defensive systems such as IDS, IPS, firewalls, and endpoints to detect attacks early?

• A. Operational Threat Intelligence
• B. Technical Threat Intelligence
• C. Incident triage
• D. Regression

Answer: (B)

Technical threat intelligence provides machine-actionable indicators that security tools can ingest and act on automatically. These indicators—such as file hashes, IP addresses, domain names, URLs, and even rules like YARA signatures—are designed to be directly deployed in defenses like IDS/IPS, firewalls, and endpoint protection. By feeding these concrete signals into the tools, teams can detect and block malicious activity as soon as it appears, often before a human analyst has time to respond. Other types focus on broader context rather than automation-ready signals: operational threat intelligence describes campaigns and actor infrastructure, which helps understand who might be behind threats but is less directly used to automate detections; strategic threat intelligence covers high-level trends and risk, not specific indicators; incident triage and regression are not categories of threat intelligence.

Technical threat intelligence provides machine-actionable indicators that security tools can ingest and act on automatically. These indicators—such as file hashes, IP addresses, domain names, URLs, and even rules like YARA signatures—are designed to be directly deployed in defenses like IDS/IPS, firewalls, and endpoint protection. By feeding these concrete signals into the tools, teams can detect and block malicious activity as soon as it appears, often before a human analyst has time to respond.

Other types focus on broader context rather than automation-ready signals: operational threat intelligence describes campaigns and actor infrastructure, which helps understand who might be behind threats but is less directly used to automate detections; strategic threat intelligence covers high-level trends and risk, not specific indicators; incident triage and regression are not categories of threat intelligence.