Threat intelligence provides evidence-based knowledge about threats — enabling informed decisions. Levels: Strategic (executive, risk decisions), Tactical (TTPs for detection), Operational (specific campaign info), Technical (IoCs for blocking).
Raw IoCs without context = low-value. Intelligence = IoCs + TTPs + actor profile + attribution + predictions. Intelligence cycle: requirements → collection → processing → analysis → dissemination → feedback. MISP, AlienVault OTX, ISACs are key platforms. Actionable intelligence improves defenses.