Simple explanation
Threat intelligence is knowledge ABOUT threats — gathered, processed, and applied. Threat hunting is proactively going looking for a compromise rather than waiting for an alert. They're related but distinct disciplines.
Technical explanation
Threat intelligence:
- The intelligence cycle — the formal process: requirements (what do we need to know) → collection → processing → analysis → dissemination → feedback, repeating continuously.
- Commodity malware — widely available, off-the-shelf malicious tools, as opposed to custom-built malware targeting a specific victim.
- Information sharing organizations — ISACs (Information Sharing and Analysis Centers), industry-specific groups that share threat intel among member organizations.
- Threat actors — understanding who's likely targeting your specific industry/organization shapes what intelligence actually matters.
- TTPs (Tactics, Techniques, and Procedures) — the behavioral patterns of a threat actor, catalogued via frameworks like MITRE ATT&CK (a matrix of known adversary techniques), the Diamond Model (analyzing an intrusion via four connected elements: adversary, capability, infrastructure, victim), and the Cyber Kill Chain (a linear model of attack stages from reconnaissance to actions on objectives).
- Confidence levels — intelligence should be rated for how reliable/verified it is, not treated as uniformly certain.
Threat hunting:
- Establish a hypothesis — hunting starts with an educated guess about what might be happening, not a random search.
- Profile threat actors and activities — using intelligence to inform what to actually hunt for.
- Threat hunting tactics — techniques for systematically searching (e.g., searching for specific TTPs rather than just IOCs, since IOCs are easy for an attacker to change while TTPs are harder to change).
- Reduce attack surface area and bundle critical assets — hunting often surfaces opportunities to tighten defenses even when no active compromise is found.
- Attack vectors — understanding likely paths in focuses the hunt.
- Integrated intelligence — combining internal telemetry with external threat intel for a fuller picture.
- Improve detection capabilities — a key GOAL of hunting is feeding findings back into automated detection, so the next similar activity triggers an alert rather than requiring another manual hunt.
Synonyms / related terms
| Term | Means | |---|---| | TTP | Tactics, Techniques, and Procedures | | ISAC | Information Sharing and Analysis Center | | IOC | Indicator of Compromise (a specific artifact, vs. TTPs which are behavioral patterns) |
Concept Check
"An analyst blocks a specific malicious IP address after an incident, but the attacker returns days later from a new IP using the identical attack technique." This illustrates exactly why hunting/detection should focus on TTPs, not just IOCs — an IP address is trivial for an attacker to rotate, but the underlying technique (the TTP) is far more expensive for them to change, making it a more durable thing to detect against.
Interview-style Q&A
Q: What's the practical difference between threat intelligence and threat hunting? A: "Threat intelligence is knowledge — understanding who's likely targeting you and how. Threat hunting is an activity — actively searching your own environment for signs that intelligence-informed activity is already present, rather than waiting for a tool to alert. Intelligence tells you what to hunt FOR; hunting is going and looking."
Memory trick
"Guess, Search, Feed Back" — the three-step heart of threat hunting: form a hypothesis, search based on it, then feed whatever you learn back into improving automated detection.