# Cyber Threat Intelligence **Aliases:** CTI **Entity class:** Intelligence discipline and operational product ## Definition **Cyber threat intelligence** is analyzed information about cyber actors, infrastructure, capabilities, vulnerabilities, malware, intent, targeting, and activity that supports defensive or investigative decisions. It turns raw telemetry or commercial data into assessed indicators, relationships, context, and courses of action. ## Relationships - **national integrator:** [[wiki/Cyber Threat Intelligence Integration Center|CTIIC]]. - **commercial sources include:** [[wiki/Searchlight Cyber|Searchlight Cyber]] and [[wiki/Team Cymru Advanced Recon|Team Cymru Advanced Recon]]. - **investigative use:** [[wiki/Homeland Security Investigations|HSI]], digital forensics, and [[wiki/Case Management and Analytics Platform|CMAP]]. - **mission domains:** [[wiki/Cybersecurity|Cybersecurity]] and [[wiki/Counterterrorism|Counterterrorism]]. ## Sources / Provenance - [NIST — Cyber Threat Information Sharing](https://csrc.nist.gov/pubs/sp/800/150/final) ## Connected marketplace roles The source article connects this entry with [[wiki/Dark-Web Monitoring|Dark-Web Monitoring]], [[wiki/Google Threat Intelligence Group|Google Threat Intelligence Group]], [[wiki/Recorded Future|Recorded Future]], [[wiki/Agentic SOC|Agentic SOC]], [[wiki/Vulnerability-Report Bounty Ecosystem|Vulnerability-Report Bounty Ecosystem]], [[wiki/CrowdStrike|CrowdStrike]], [[wiki/Arctic Wolf|Arctic Wolf]]. These routes locate the associated people, implementations, methods, and operational contexts in [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. **Collections:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]]. ## Connected Austin capabilities [[wiki/State Threat-Intelligence Center|State Threat-Intelligence Center]]. These entries identify associated implementations, people, methods, and institutional contexts in [[articles/How Austin Became a Different Kind of Defense Tech Epicenter|How Austin Became a Different Kind of Defense Tech Epicenter]]. [[wiki/Austin Defense Technology|Austin Defense Technology]] supplies their regional arrangement; [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] supplies the wider supplier and participation economy.