1What Cyber Threat Intelligence Is: Reactive vs ProactiveThreat intelligence is not a feed of raw data — it is refined, decision-ready knowledge about adversaries, produced on a repeatable cycle and used to act before and after attacks.Threat Intelligence 2Indicators of Compromise and the Pyramid of PainIndicators are the traces an attack leaves behind — but they are not equal. Some cost an attacker nothing to change; some force them to rebuild everything.Threat Intelligence 3Defanging Indicators: Sharing Them SafelyA live malicious link is dangerous the moment it's written down. Defanging turns indicators into inert text so they can be shared without anyone — or anything — accidentally acting on them.Threat Intelligence 4The Diamond Model of Intrusion AnalysisEvery intrusion links four things — an adversary, a capability, some infrastructure, and a victim. The Diamond Model makes those relationships explicit, so one clue can lead you to the rest.Threat Intelligence 5Traffic Light Protocol: Sharing Intelligence ResponsiblyThreat intelligence is only useful when it's shared — but sharing the wrong thing widely can do harm. The Traffic Light Protocol is a simple, standard way to say exactly how far a report may travel.Threat Intelligence