SOC Operations
Intermediate 17 min read SOC Operations

Threat Intelligence Essentials

From IOC feeds to finished intelligence: what intel types exist, which are operational, and how to consume intel without drowning in indicators.

threat intelIOCTTPCTIfeedsheap of indicators
Prerequisites: MITRE ATT&CK What Is a SOC
Introduction

What is this?

Threat intelligence turns raw signals (IOCs, adversary chatter, campaign reports) into decision-useful knowledge for defense prioritization.

Motivation

Why do you need it?

  • Blind defense blocks everything; intel focuses your finite detection and patch budget on what your specific adversaries actually do.
  • IOC feeds alone drown you in noise; the craft is turning indicators back into context and action.
  • Every SOC/responsiveness vacuum gets filled with uninformed prioritization — intel is the antidote.
Think about it

Mental model

Imagine

Newspaper headlines

Think of

A scout's dossier on your neighborhood felon

Headlines tell everyone; the dossier tells YOU which knock sounds wrong at YOUR door.

Mechanics

How it works

  • Strategic intel: long-horizon trends and risk framing for leadership.
  • Tactical intel: campaigns, malware families, TTPs — the 'how' of your adversaries.
  • Operational/tactical feeds: IOCs (hashes, IPs, domains) consumed by your sensors and SIEM.
  • Prioritization: relevance + confidence + actionability separate 'used' intel from 'subscribed' intel.

From signal to action

Collect
Analyze
Prioritize
Act
Feed back
Real world

In production

  • A SOC auto-ingests curated IOC feeds into its SIEM watchlist, then triages only the joins that matter.
  • A bank subscribes to sector-specific intel (financial campaign TTPs) and writes two new detections from it quarterly.
  • An incident team releases a private IOC blast: their compromised host pattern lands in the feed for peer defenders (with care).
Guidelines

Best practices

  • Consume by relevance: sector, region, and your tech stack define which feeds earn their storage.
  • Turn intel into rules, not ticket noise: an IOC with no rule is decoration.
  • Prefer intel that explains TTPs over raw hashes; behavior survives the next variant.
  • Share findings responsibly through trusted channels, never raw victim data.
Watch out

Common mistakes

  • Subscribing to 20 feeds and alerting on every hit — the IOC lawn gets mowed into silence.
  • Treating intel as 'buy more subscriptions' rather than 'prioritize what to detect'.
  • Acting on unvetted intel: false-positive IOCs burn response hours and credibility.
  • Hoarding intel privately instead of contributing the harmless, high-value observations.
When things break

Debugging tips

  • When an IOC 'matches', validate with at least two independent sources before responding.
  • Map a campaign report's TTPs to your estate's attack-surface table — what do you share with the victim?
  • Measure intel value by rules added + alerts triaged, not by feed bytes.
Security

Security considerations

  • Intel sharing has liability and legality edges; share IOCs, never victim identity or credentials.
  • Keep sources confidential per the feed agreement; leaky handlers lose access for everyone.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

The most actionable intel form for a SOC is...

2

An IOC that 'matches' is best treated as...

Go deeper

Official documentation

MISP threat intel platform
docs
STIX/TAXII standards
docs