Threat Intelligence Classification

Introduction

Cyber threats pose significant risks to organizational information, technology infrastructure, business operations, and digital services. Organizations need to understand potential threats, identify malicious activities, and anticipate attack scenarios to establish effective cybersecurity defenses. This requires more than collecting security events and incident data; it requires gathering, analyzing, and interpreting information about threats to produce actionable intelligence.

Threat Intelligence is the process of collecting, processing, analyzing, and interpreting information about potential or existing threats to understand threat actors, their motivations, capabilities, activities, and attack methods. In cybersecurity, Cyber Threat Intelligence (CTI) helps organizations understand the threat environment, identify potential adversaries, recognize emerging attack patterns, and assess threats that could affect their information assets and business operations.

Threat intelligence serves different purposes across an organization, from supporting executive-level security decisions to enabling technical teams to detect and respond to malicious activities. To address these different requirements, Cyber Threat Intelligence is commonly classified into four primary categories: Strategic, Operational, Tactical, and Technical Threat Intelligence. Each classification provides a different level of insight into cyber threats and supports specific cybersecurity functions, helping organizations translate threat information into actionable security measures.

Understanding Threat Intelligence Classification

Threat Intelligence Classification is the process of organizing and categorizing threat intelligence according to its purpose, level of detail, operational relevance, and intended use. It helps organizations determine how intelligence can support business decisions, understand adversary activities, improve security operations, and strengthen technical defenses.

The four commonly used categories of threat intelligence are Strategic, Operational, Tactical, and Technical. These categories represent different perspectives and levels of detail rather than sequential stages. They are interconnected, and information about a single threat may contribute to more than one category.

Purpose of Threat Intelligence Classification

Threat intelligence classification helps organizations organize intelligence according to the needs of different stakeholders and security functions. Its primary purposes include:

• Supporting Security Decision-Making: Providing relevant threat insights to executive leadership, CISOs, and risk management teams to support cybersecurity strategy and investment decisions.
• Understanding Threat Actors: Identifying adversaries, their motivations, objectives, capabilities, and activities.
• Identifying Adversary Behavior: Understanding the tactics, techniques, and procedures used by threat actors to compromise systems and networks.
• Supporting Threat Detection: Providing indicators and technical intelligence that security tools and teams can use to identify malicious activities.
• Improving Incident Response: Helping incident response teams understand attack methods, assess threats, and determine appropriate response measures.
• Strengthening Threat Hunting: Enabling security teams to investigate suspicious activities and identify potential threats that may not have triggered existing security controls.
• Improving Cyber Risk Management: Helping organizations understand threat exposure, assess potential business impacts, and prioritize security measures.

Importance of Threat Intelligence Classification

Different stakeholders within an organization require different levels of threat information to perform their responsibilities effectively. The nature, depth, and relevance of intelligence vary depending on whether it is used for strategic decision-making, threat assessment, security operations, or technical detection. Providing the same level of information to every stakeholder may result in unnecessary technical complexity for management or insufficient operational detail for security teams.

Executive leadership, including the CEO, CIO, and CISO, primarily requires strategic threat intelligence to understand the broader cyber threat landscape, assess potential business impacts, evaluate organizational exposure, and establish security priorities. This information supports enterprise risk management, cybersecurity strategy, resource allocation, and decisions concerning the protection of critical business services and information assets.

Threat intelligence and cybersecurity risk management teams require operational intelligence to understand threat actors, their motivations, capabilities, objectives, and attack campaigns. This information helps them assess which adversaries may target the organization, understand the nature of targeted attacks, evaluate potential exposure, and provide relevant threat assessments to security leadership.

SOC analysts, incident responders, and threat hunters rely on tactical intelligence to understand adversary tactics, techniques, and procedures. This enables them to recognize attack patterns, investigate suspicious activities, develop threat hunting hypotheses, improve detection capabilities, and respond to security incidents.

Security engineers and technical security teams use technical intelligence to identify specific indicators associated with malicious activities. Information such as malicious IP addresses, domains, URLs, file hashes, and malware signatures can be incorporated into security technologies, including SIEM, EDR, firewalls, IDS/IPS, and DNS filtering systems, to support threat detection, investigation, and prevention.

Threat intelligence classification therefore establishes a structured approach to organizing and distributing intelligence according to stakeholder responsibilities and operational requirements. It helps connect executive-level security decisions with threat analysis, security operations, and technical defense mechanisms, ensuring that intelligence is relevant, actionable, and useful throughout the organization.

Threat Intelligence Classification Across the Life Cycle

Threat intelligence classification is connected to the intelligence lifecycle, but it does not occur equally across all phases. The lifecycle describes how threat intelligence is developed, while classification determines the nature, level of detail, purpose, and intended audience of the resulting intelligence. Classification requirements are identified during planning, refined through analysis, and maintained as intelligence is disseminated and evaluated.

Planning and Direction

During this phase, organizations identify their intelligence requirements, business priorities, and intended audiences. These requirements help establish the type of intelligence needed, such as strategic intelligence for executive decision-making or technical intelligence for security monitoring. This provides an initial direction for classification.

Collection

Information is gathered from relevant sources based on the identified intelligence requirements. Sources may include threat feeds, security logs, incident reports, threat research, and open-source intelligence. The collected information provides the raw material for developing different categories of threat intelligence but is not necessarily assigned a final classification at this stage.

Processing

Collected information is organized, filtered, normalized, and enriched to make it suitable for analysis. Preliminary categorization may help identify relevant threat actors, attack techniques, indicators, and campaigns. However, the final intelligence classification depends on the context and findings established during analysis.

Analysis and Production

This is the primary phase in which threat intelligence classification is established or refined. Analysts correlate information, assess its relevance, identify patterns, and develop meaningful insights. Based on the findings, intelligence is categorized as strategic, operational, tactical, or technical according to its purpose, level of detail, and intended use.

Dissemination

The developed intelligence is shared with relevant stakeholders according to their responsibilities and information requirements. Strategic intelligence may be delivered to executive leadership, operational intelligence to threat intelligence and incident response teams, tactical intelligence to security analysts and threat hunters, and technical intelligence to security monitoring and detection systems.

Feedback

Stakeholder feedback helps determine whether the intelligence was relevant, actionable, and useful. This feedback may lead to adjustments in intelligence requirements, collection priorities, analysis methods, and classification needs for subsequent intelligence activities.

Threat Intelligence Classification

Threat intelligence is commonly classified into four categories based on the nature of the information, its level of detail, intended audience, and operational purpose. Each category provides a different perspective on cyber threats and supports specific organizational and cybersecurity requirements.

Strategic Threat Intelligence

Strategic Threat Intelligence provides a high-level understanding of the cyber threat landscape, emerging threats, adversary trends, geopolitical developments, and potential business impacts. It helps executive leadership, CISOs, and risk management teams understand how cyber threats could affect organizational objectives, business operations, financial stability, and long-term security priorities.

Strategic intelligence focuses on the broader implications of cyber threats rather than the technical details of individual attacks. It supports cybersecurity strategy, enterprise risk management, security investment planning, and executive decision-making.

Strategic Objectives and Business Context

Strategic threat intelligence considers the organization’s business objectives, operating environment, critical services, financial exposure, and regulatory obligations. It helps leadership understand how cyber threats could affect business continuity, organizational reputation, customer trust, and financial performance.

Key areas include:

• Business impact and operational exposure.
• Enterprise cybersecurity risk.
• Security investment priorities.
• Cybersecurity strategy and resource allocation.
• Regulatory and industry-specific threats.
• Protection of critical business services and information assets.

For example, a financial institution may use strategic intelligence to assess the potential impact of ransomware, financial fraud, and attacks against critical banking services when determining its cybersecurity investment priorities.

Threat Landscape and Emerging Trends

Strategic intelligence examines the broader cyber threat environment to identify significant developments, emerging attack patterns, and changes in adversary activities. It helps organizations understand how the threat landscape may evolve and what risks could affect their business and technology environments.

Examples include:

• Increasing ransomware activity against critical industries.
• State-sponsored cyber espionage targeting sensitive information.
• Cyber attacks against critical infrastructure.
• Supply chain compromises affecting software and service providers.
• Emerging security risks associated with artificial intelligence and cloud environments.

Understanding these trends helps organizations anticipate potential threats and adjust their security strategies accordingly.

Geopolitical and Industry-Specific Threats

Geopolitical developments, international conflicts, economic tensions, and national security interests can influence cyber threat activities. Strategic intelligence helps organizations understand how these developments may create cyber risks for particular industries, regions, and business operations.

Industry-specific threat intelligence is particularly relevant to sectors such as:

• Banking and Financial Services.
• Healthcare.
• Telecommunications.
• Energy and Utilities.
• Government and Public Sector.
• Manufacturing and Critical Infrastructure.

For example, geopolitical tensions may increase the risk of cyber espionage or disruptive attacks against energy and telecommunications organizations.

Strategic Risk Assessment and Decision-Making

Strategic intelligence supports enterprise-level cyber risk assessment by helping leadership understand significant threats and their potential business consequences. It provides context for prioritizing risks, allocating resources, and strengthening security governance.

Organizations use strategic intelligence to:

• Identify significant cyber threats affecting business objectives.
• Assess potential financial, operational, and reputational impacts.
• Prioritize cybersecurity investments.
• Strengthen enterprise security strategies.
• Support executive risk discussions and governance decisions.
• Align cybersecurity initiatives with business priorities.

Operational Threat Intelligence

Operational Threat Intelligence provides information about specific threat actors, their motivations, objectives, capabilities, and attack campaigns. It helps organizations understand who may be targeting them, why they are being targeted, and how adversaries plan and execute their activities.

Operational intelligence focuses on the context surrounding cyber attacks, including the activities of threat groups, their targets, infrastructure, and campaign patterns. It supports threat intelligence analysts, incident response teams, and security leadership in preparing for and responding to targeted threats.

Threat Actor Identification and Profiling

Threat actor identification involves recognizing and profiling individuals, groups, or organizations responsible for malicious cyber activities. Profiling helps organizations understand adversaries and assess the risks they may pose.

Common threat actor categories include:

• Nation-State Actors: Groups supported or directed by governments, often involved in espionage, intelligence gathering, or strategic disruption.
• Cybercriminal Groups: Criminal organizations conducting activities such as ransomware, financial fraud, data theft, and extortion.
• Hacktivists: Individuals or groups motivated by political, social, or ideological objectives.
• Insider Threats: Employees, contractors, or other trusted individuals who intentionally or unintentionally expose organizational information and systems.
• Advanced Persistent Threat (APT) Groups: Organized and capable threat groups that conduct sustained, targeted cyber operations.
• Ransomware Operators: Threat actors responsible for developing, distributing, or operating ransomware campaigns.

Threat Actor Motivations and Objectives

Understanding threat actor motivations helps organizations assess why particular systems, industries, or information assets may be targeted. Different adversaries may pursue different objectives depending on their interests, capabilities, and resources.

Common motivations include:

• Financial Gain: Stealing money, conducting financial fraud, or demanding ransom payments.
• Espionage: Gathering confidential, political, military, or business information.
• Political or Ideological Objectives: Promoting political causes, influencing public opinion, or disrupting organizations.
• Disruption and Destruction: Interrupting business operations or damaging critical systems and infrastructure.
• Data and Intellectual Property Theft: Obtaining sensitive information, proprietary data, and trade secrets.
• Competitive Advantage: Conducting industrial espionage or obtaining commercially valuable information.

Understanding these motivations helps organizations assess potential targets and anticipate adversary behavior.

Attack Campaign Analysis

Attack campaign analysis examines coordinated malicious activities conducted by threat actors against specific targets or groups of organizations. It helps identify relationships between individual attacks and broader adversary operations.

Analysts examine campaign characteristics such as:

• Targeted organizations and industries.
• Threat actor identities and associated groups.
• Attack timelines and campaign duration.
• Adversary infrastructure and resources.
• Techniques and methods used during attacks.
• Malware, tools, and supporting services.
• Objectives and intended outcomes.

For example, a ransomware campaign targeting healthcare organizations may involve phishing emails, compromised credentials, exploitation of exposed systems, lateral movement, data theft, and ransomware deployment. Understanding the campaign helps organizations anticipate related attack activities and strengthen their defenses.

Target Selection and Attack Planning

Operational intelligence examines how threat actors select targets and plan their attacks. Target selection may depend on financial value, geopolitical interests, industry importance, sensitive information, or weaknesses in an organization’s security environment.

Analysts assess factors such as:

• Industry and business sector.
• Geographic location and geopolitical relevance.
• Value of organizational data and intellectual property.
• Exposure of internet-facing systems and services.
• Security weaknesses and exploitable vulnerabilities.
• Dependencies on third-party providers and supply chains.

This information helps organizations understand their potential exposure to targeted attacks and prepare appropriate defensive measures.

Tactical Threat Intelligence

Tactical Threat Intelligence focuses on the tactics, techniques, and procedures (TTPs) used by threat actors to conduct cyber attacks. It explains how adversaries gain access, execute malicious activities, maintain persistence, move through environments, and achieve their objectives.

Tactical intelligence provides practical information that security teams can use to identify adversary behavior, improve detection capabilities, conduct threat hunting, and strengthen incident response.

It is primarily used by SOC analysts, threat hunters, incident responders, and security engineers.

Adversary Tactics, Techniques, and Procedures (TTPs)

Tactics, Techniques, and Procedures describe different levels of adversary behavior during a cyber attack.

• Tactics: Represent the adversary’s objectives or goals during an attack.
• Techniques: Describe the methods used by adversaries to achieve those objectives.
• Procedures: Explain the specific implementation or sequence of actions used to execute a technique.

For example, an adversary may use phishing as an initial access technique. The procedure may involve sending a targeted email containing a malicious attachment or link to an employee to obtain access to the organization’s environment.

Understanding TTPs helps security teams recognize attack patterns and develop detection and prevention measures based on adversary behavior.

MITRE ATT&CK Framework

The MITRE ATT&CK Framework is a globally recognized knowledge base that documents adversary tactics and techniques based on real-world observations. It provides a structured approach for understanding and analyzing adversary behavior across different technology environments.

MITRE ATT&CK organizes adversary behavior into tactics, techniques, and sub-techniques. Its Enterprise Matrix includes tactics such as:

• Reconnaissance.
• Resource Development.
• Initial Access.
• Execution.
• Persistence.
• Privilege Escalation.
• Defense Evasion.
• Credential Access.
• Discovery.
• Lateral Movement.
• Collection.
• Command and Control.
• Exfiltration.
• Impact.

Organizations use MITRE ATT&CK to map observed adversary behavior, identify security gaps, develop detection rules, conduct threat hunting, and assess defensive capabilities.

Attack Lifecycle and Adversary Behavior

Tactical intelligence helps organizations understand the sequence of activities that adversaries may perform during an attack. These activities can include:

• Gaining initial access through phishing, stolen credentials, or exploitation of vulnerabilities.
• Executing malicious commands, scripts, or applications.
• Establishing persistence to maintain access to compromised systems.
• Escalating privileges to obtain higher levels of access.
• Evading security controls and detection mechanisms.
• Stealing credentials and moving laterally across the environment.
• Collecting sensitive information and preparing it for exfiltration.
• Exfiltrating data or disrupting business operations.

Understanding these activities helps security teams identify suspicious behavior and detect attacks at different stages.

Threat Hunting and Detection Strategies

Tactical intelligence supports proactive threat hunting by providing information about adversary behavior, attack techniques, and potential indicators of compromise. Security teams use this information to investigate suspicious activities that may not have been detected by existing security controls.

Common activities include:

• Developing threat hunting hypotheses based on known adversary techniques.
• Investigating unusual endpoint and network activities.
• Identifying suspicious authentication and access patterns.
• Correlating security events using Security Information and Event Management (SIEM) platforms.
• Monitoring endpoint, network, and cloud environments.
• Identifying gaps in existing detection capabilities.
• Developing and improving security detection use cases.

This enables organizations to identify potential threats earlier and improve their ability to detect sophisticated attacks.

Technical Threat Intelligence

Technical Threat Intelligence focuses on specific technical indicators, artifacts, and signatures associated with malicious cyber activities. It provides actionable information that security tools and technical teams can use to identify, block, investigate, and respond to threats.

Technical intelligence commonly includes Indicators of Compromise (IOCs), malicious IP addresses, domains, URLs, file hashes, malware signatures, and Command and Control (C2) infrastructure details.

It is primarily consumed by security monitoring systems and technical teams responsible for threat detection and response, including SOC analysts, incident responders, and security engineers.

Indicators of Compromise (IOCs)

Indicators of Compromise are observable artifacts or evidence that may indicate a system, network, or application has been compromised or involved in malicious activity.

Common IOCs include:

• Malicious IP addresses.
• Suspicious domains and URLs.
• Malicious file hashes.
• Malware signatures.
• Suspicious email addresses.
• Unusual network connections.
• Unexpected system modifications.
• Known malicious file and process artifacts.

IOCs help security teams identify known threats and investigate potentially compromised systems. However, an individual indicator does not always confirm malicious activity and should be evaluated in context.

Malware Signatures and File Hashes

Malware signatures and file hashes help identify known malicious files and applications. A file hash is a unique value generated by applying a cryptographic hash function to a file. Security teams commonly use SHA-256 hashes to identify and compare files.

For example, an endpoint security platform can compare a file’s hash against known malicious file indicators to determine whether it matches a previously identified malware sample.

Malware signatures and hashes are commonly used by antivirus platforms, Endpoint Detection and Response (EDR) solutions, and threat intelligence platforms to support malware identification and detection.

Malicious IP Addresses, Domains, and URLs

Threat actors use malicious IP addresses, domains, and URLs to host malware, distribute phishing content, communicate with compromised systems, and operate malicious infrastructure.

Technical intelligence may include:

• IP addresses associated with known malicious infrastructure.
• Domains used for phishing and malware distribution.
• URLs hosting malicious files or redirecting users to harmful websites.
• Domains associated with suspicious Command and Control infrastructure.
• Newly registered or suspicious domains linked to malicious activities.

Security teams use these indicators in firewalls, DNS filtering systems, web proxies, email security platforms, and SIEM solutions to detect or block known malicious connections.

Command and Control (C2) Indicators

Command and Control infrastructure enables threat actors to communicate with compromised systems and remotely control their activities. Malware and other malicious tools may establish communication with external servers to receive instructions, transmit stolen information, or download additional payloads.

Technical intelligence related to C2 infrastructure may include:

• Known C2 server IP addresses.
• Malicious domains and URLs.
• Suspicious DNS queries.
• Unusual outbound network connections.
• Known C2 communication protocols and patterns.
• Network signatures associated with malicious communication.

Organizations use this information to identify suspicious communications between internal systems and external infrastructure.

Technical Indicators and Detection Rules

Technical threat intelligence can be translated into detection rules and security controls to identify malicious activities across an organization’s technology environment.

Common technologies and methods include:

• SIEM Detection Rules: Correlating security events and identifying suspicious activities using threat indicators and behavioral patterns.
• YARA Rules: Identifying and classifying malware based on patterns within files or file contents.
• Sigma Rules: Defining generic detection rules that can be translated into different SIEM and security analytics platforms.
• IDS/IPS Signatures: Detecting and preventing known malicious network traffic and attack patterns.
• EDR Detection Rules: Identifying suspicious endpoint activities, malicious processes, and potential compromise indicators.
• Firewall and DNS Filtering: Blocking known malicious IP addresses, domains, and network connections.

These detection mechanisms help organizations operationalize technical intelligence and strengthen security monitoring capabilities.

Relationship Between Threat Intelligence Classifications

Strategic, Operational, Tactical, and Technical Threat Intelligence are interconnected categories. Each provides a different perspective on cyber threats, and together they help organizations understand threats from a business-level perspective down to specific technical indicators.

The categories are not independent or strictly sequential. Intelligence developed in one category can contribute to another, depending on its relevance, context, and intended use.

For example, consider a ransomware threat targeting organizations in the healthcare sector:

• Strategic Intelligence: Identifies ransomware as a significant business risk to healthcare organizations and highlights its potential impact on patient services, financial stability, and business continuity.
• Operational Intelligence: Provides information about the threat actors conducting ransomware campaigns, their motivations, targeted organizations, and attack infrastructure.
• Tactical Intelligence: Explains the techniques and procedures used by the adversaries, such as phishing, credential theft, privilege escalation, and lateral movement.
• Technical Intelligence: Provides specific indicators such as malicious IP addresses, domains, file hashes, and malware signatures that security tools can use for detection.

By combining these categories, organizations can connect broader threat assessments with adversary behavior and actionable technical indicators. This improves threat understanding, supports security decision-making, and strengthens defensive capabilities.

Comparison of Threat Intelligence Classifications

The following table summarizes the four threat intelligence classifications across their focus areas, objectives, information types, audiences, and operational applications.

Comparison Aspect	Strategic Threat Intelligence	Operational Threat Intelligence	Tactical Threat Intelligence	Technical Threat Intelligence
Primary Focus	Overall cyber threat landscape and business impact.	Threat actors, motivations, objectives, and attack campaigns.	Adversary tactics, techniques, and procedures (TTPs).	Technical indicators, artifacts, and malicious signatures.
Key Objective	Support strategic cybersecurity decisions and enterprise risk management.	Understand adversaries and anticipate targeted attack activities.	Understand adversary behavior and improve detection and response capabilities.	Identify, detect, and block known malicious activities using technical indicators.
Key Questions	What cyber threats could affect the organization and its business objectives?	Who is targeting the organization, why are they targeting it, and what are their capabilities?	How do threat actors execute attacks and achieve their objectives?	What technical indicators can identify malicious activities?
Level of Detail	High-level and business-oriented.	Contextual and campaign-oriented.	Behavioral and technique-oriented.	Specific and technically detailed.
Type of Information	Threat trends, industry risks, geopolitical developments, business exposure, and emerging threats.	Threat actor profiles, motivations, capabilities, targets, infrastructure, and campaign information.	Tactics, techniques, procedures, attack patterns, and adversary behavior.	IP addresses, domains, URLs, file hashes, malware signatures, and C2 indicators.
Primary Audience	CEO, CIO, CISO, executive leadership, and enterprise risk management teams.	Threat intelligence analysts, incident response teams, and cybersecurity risk teams.	SOC analysts, threat hunters, incident responders, and security engineers.	SOC analysts, detection engineers, security engineers, and security monitoring teams.
Operational Application	Cybersecurity strategy, risk assessment, security investment, and governance decisions.	Threat actor assessment, campaign analysis, threat prioritization, and incident preparation.	Threat hunting, detection engineering, incident investigation, and security control improvement.	IOC matching, threat blocking, SIEM correlation, malware detection, and security monitoring.
Common Sources	Industry threat reports, geopolitical assessments, executive threat briefings, and strategic intelligence reports.	Threat research reports, campaign investigations, threat actor assessments, and intelligence-sharing communities.	MITRE ATT&CK, adversary behavior research, attack investigations, and threat hunting findings.	Threat intelligence feeds, malware analysis, IOC repositories, and technical security advisories.
Typical Output	Strategic threat assessments, business risk reports, and executive intelligence briefings.	Threat actor profiles, campaign assessments, and operational threat reports.	Adversary behavior analysis, TTP mappings, and threat hunting hypotheses.	IOC lists, malware signatures, detection rules, and blocklists.
Typical Time Horizon	Long-term and forward-looking.	Medium-term and campaign-oriented, although it may also address active threats.	Near-term and activity-oriented.	Immediate and indicator-oriented, although indicators may remain relevant over longer periods.

These four classifications are complementary rather than mutually exclusive. A single threat investigation may produce strategic, operational, tactical, and technical intelligence, depending on the information developed and its intended application.

Threat Intelligence Classification in Cybersecurity Operations

Threat intelligence classification supports different cybersecurity functions by providing relevant information according to their operational responsibilities and requirements.

Security Operations Center (SOC)

The SOC uses tactical and technical threat intelligence to monitor security events, identify suspicious activities, detect known indicators, and investigate potential threats. Intelligence can be incorporated into SIEM, EDR, IDS/IPS, and other security monitoring platforms to improve detection capabilities.

Incident Response

Incident response teams use operational, tactical, and technical intelligence to understand the nature of an attack, identify threat actors and their activities, investigate indicators of compromise, and determine appropriate containment, eradication, and recovery measures.

Threat Hunting

Threat hunters use tactical and technical intelligence to develop hypotheses, investigate adversary behavior, identify suspicious activities, and discover potential threats that may have bypassed existing security controls.

Security Monitoring and Detection Engineering

Security monitoring and detection engineering teams use technical intelligence, along with tactical information about adversary techniques, to develop and improve detection rules, correlation logic, and monitoring capabilities across endpoint, network, cloud, and application environments.

Cyber Risk Management

Cyber Risk management teams use strategic and operational intelligence to understand the threat landscape, assess potential business impacts, identify significant risk exposures, and prioritize cybersecurity risk treatment and investment decisions.

References

Online Sources

MITRE – MITRE ATT&CK Framework
Provides a knowledge base of adversary tactics, techniques, and procedures based on real-world observations

NIST – Guide to Cyber Threat Information Sharing (SP 800-150)
Provides guidance on cyber threat information sharing, including the development, collection, analysis, and dissemination of cyber threat information

CISA – Cybersecurity Advisories
Provides cybersecurity advisories and technical information about cyber threats, vulnerabilities, threat actors, and malicious activities