All guides
← All guides

Threat intelligence

Posture & operations
On this page

In plain terms

Threat intelligence is knowledge about active, real-world threats, malicious domains, URLs, IP addresses, and file hashes that are known to be part of attacks. In an application-security context, it's used to check the things your software touches, an outbound URL, a dependency's download source, an artifact's hash, against feeds of known-bad indicators of compromise (IOCs).

Why it matters

The other controls in this handbook ask "is this code/config insecure?" Threat intelligence asks a different question: "is this thing known to be malicious right now?" That catches issues the structural checks miss, a dependency that started pointing at a compromised host, a URL in your config that's on a phishing blocklist, an artifact whose hash matches known malware. It's a reputation and freshness signal layered on top of static analysis.

Where it fits

  • Artifact: external indicators referenced by your software, URLs, domains, IPs, file hashes.
  • Stage: at scan time as an enrichment, and continuously, reputation changes daily as new threats are discovered.

How it works

A threat-intel check extracts indicators from your project (or a set of findings) and queries them against one or more feeds, some free and open, some commercial or key-gated. A match raises a high-confidence alert; the value depends heavily on the freshness and quality of the feed.

Two questions about the same host The controls that read your code, your images and your endpoints all ask the same shape of question: is what I put here insecure. They can only ask it of the paths somebody knows about. Threat intelligence asks whether anybody else has already observed this host serving malware, which is answered from a record other people wrote, and which therefore covers paths nobody on your side ever deployed. Neither question can be derived from the other. TWO QUESTIONS ABOUT ONE HOST EVERY OTHER CONTROL Is what I put here insecure? answered by looking at the thing covers the paths somebody knows about Complete, for the parts you declared. THREAT INTELLIGENCE Has anybody already seen this host serving malware? answered from a record other people wrote Covers a path you never deployed. Neither question can be derived from the other. A clean scan of your own endpoint is not evidence that nobody has seen this host serving malware.
The cost of the second question is that asking it tells somebody your host exists. That is a disclosure the run declares before it happens, and a hostname is all that leaves the machine.

Popular & reputable sources

SourceNotes
URLhausFree feed of malicious URLs (abuse.ch)
VirusTotalAggregates many engines; API is key-gated
AlienVault OTXOpen threat-exchange community feeds
MISPOSS Malware Information Sharing Platform

Common pitfalls

  • Feed quality is everything. A stale or low-quality feed produces noise or misses; choose reputable, current sources.
  • Rate limits and keys. Commercial feeds (VirusTotal) gate access, plan for API limits and bring-your-own-key.
  • It's a signal, not a verdict. A reputation hit warrants investigation, but context still decides the response.
How Draugr fits. The threats control ships today. Enable it on a component's hosts: and Draugr asks whether those hosts are already known to serve malware, abuse.ch URLhaus by default, with VirusTotal available as an opt-in second opinion. Both are bring-your-own-key and normalize to SARIF like every other control.

It answers something no scan of your own endpoint can. A scanner you point at your host checks the paths you know about; this asks whether somebody else has already seen that host serving malware from a path you never deployed. Malware being served now is an error; a host that served it once is a warning, because treating a years-old record as an emergency is how a control gets switched off.

It is also the one control that tells a third party your hosts exist, so it declares that as a disclosure effect, shown before the scan runs and recorded in the report, and each scanner documents exactly what leaves your machine. Nothing but the hostname does. See scanner effects for the four kinds and which of them a descriptor has to accept, and per-scanner config for turning VirusTotal on.

Keep learning

  • EPSS & KEV, exploitability signals for known vulnerabilities
  • SCA, the dependencies threat intel helps vet