A threat intelligence platform (TIP) is software that gathers threat information from many sources, such as commercial feeds, open-source lists, government advisories, industry sharing groups and your own investigations, then removes duplicates, adds context, scores how reliable and relevant each item is, and distributes it to security tools and analysts. It is the system that manages cyber threat intelligence (CTI); it does not create insight on its own and is only as good as the sources and people behind it.
At a glance
- A TIP collects, normalizes, deduplicates, enriches and scores threat data from many sources.
- It pushes curated intelligence, such as indicators of compromise (IOCs), to SIEM, SOAR, firewall, email and endpoint tools.
- It helps analysts research indicators and track attacker tactics, techniques and procedures (TTPs).
- Many organizations get intelligence built into their SIEM, XDR or managed service instead of running a standalone TIP.
- Value depends on source quality, tuning and having people who use it.
What problem it solves
Threat intelligence arrives in many forms and formats: lists of malicious IP addresses and domains, file hashes, vendor reports, government alerts and posts from information sharing and analysis centers (ISACs). Much of it overlaps, some is outdated, and some has nothing to do with your environment. Loading it all directly into security tools creates noise and alert fatigue, and leaving it unused wastes the subscription.
A TIP organizes that intelligence. It keeps one record per indicator, tracks where it came from and how confident the sources are, sets expiry dates so stale indicators drop out, and sends only what is relevant to the tools that can act on it.
How it works
Collect. The platform ingests feeds and reports through APIs and standard formats. STIX is a widely used format for describing threat information, and TAXII is a protocol for exchanging it. Analysts can also add intelligence from their own investigations.
Normalize and deduplicate. Data from different sources is converted into a common structure, and duplicates are merged.
Enrich and score. The platform adds context, such as which campaign or group an indicator is linked to, often mapped to frameworks like MITRE ATT&CK, and assigns a confidence and severity score. Some platforms use machine learning to help with scoring.
Distribute. Curated intelligence is sent to tools such as a SIEM to match against logs, firewalls and email gateways to block, endpoint tools to detect, and SOAR playbooks to automate response. How much is automatic depends on your configuration.
Support analysts. Analysts use the TIP to research an indicator during an investigation or to plan threat hunting, and they feed what they learn back into the platform.
When it matters for buyers
- When you pay for several feeds. A TIP can show which ones add unique, useful data.
- When you have a security operations team. Analysts who investigate and hunt get the most from a TIP.
- When you share intelligence with an ISAC or partners. Sharing is easier with a platform that supports common standards.
- When evaluating SIEM, XDR or managed services. Ask what intelligence is built in before buying a separate TIP; many mid-sized organizations find built-in intelligence or a provider’s service is enough. See our security operations center overview for managed options.
Questions to ask vendors
- Which feeds and sources are included, and which cost extra?
- Which standards (such as STIX and TAXII) and integrations do you support, and which of our tools can receive intelligence from you?
- How do you score confidence and relevance, and can we adjust the scoring?
- How are indicators aged out so stale data doesn’t cause false blocks?
- Can intelligence be pushed for automatic blocking, and what safeguards prevent blocking legitimate traffic?
- Is the platform delivered as SaaS or self-hosted, and how is it priced (by user, source or volume)?
- How would this overlap with the intelligence already in our SIEM, XDR or email security tools?
How it differs from cyber threat intelligence (CTI)
Cyber threat intelligence (CTI) is the analyzed information itself, about attackers, their methods and their targets, along with the practice of producing and using it. A threat intelligence platform is software for managing that information: collecting it, organizing it and getting it to the right tools and people. You can practice CTI without a dedicated TIP, using intelligence built into your SIEM or XDR tools, and a TIP without skilled people to interpret its output adds little.
Problems this helps with
- We subscribe to several threat feeds and can't use them all
- Analysts waste time researching the same indicators by hand
- Our security tools block different things because they use different intelligence
