Threat intelligence is evidence-based knowledge about existing or emerging threats, collected and analyzed to help make better security decisions. That is a broad definition, and deliberately so: threat intelligence spans everything from a raw list of malicious IPs to a detailed report on a specific attacker group's tactics. What ties it together is the goal, turning observation into a decision you can act on.
The three common tiers
- Strategic: high-level trends aimed at decision-makers, such as which industries are being targeted, which attack types are rising, and what regulatory shifts are coming. Long shelf life, low technical detail.
- Operational: details about specific campaigns or threat actor behavior, such as what infrastructure a group uses and what techniques they favor. Useful for planning defenses ahead of an attack.
- Tactical: the ground level: IOCs, malware hashes, malicious domains, and CVE details that can be fed directly into monitoring tools. Short shelf life, immediately actionable.
Most free, publicly available threat intelligence, the kind that powers feeds like URLhaus, AlienVault OTX, or the NVD, sits at the tactical level. It answers "what is happening right now" rather than "who is doing it and why," which is exactly what makes it useful for automated monitoring.
Why it matters even at small scale
Threat intelligence is often framed as an enterprise SOC capability, but the tactical tier is accessible to anyone. Free feeds already do the work of aggregating what researchers worldwide have observed. The value for a smaller team is simply in consuming that data continuously instead of finding out about a compromised IP or a newly disclosed CVE after the fact.
How this fits together on fry.ee
Our dashboard is built entirely on public, free tactical intelligence: live IOCs from URLhaus and ThreatFox, malicious IP reports from AbuseIPDB, and CVE disclosures from the NVD feed, refreshed on a schedule. It is threat intelligence in its most practical form, not a report to read once, but a feed you can glance at daily to know what changed.