Threat intelligence
In plain terms#
Threat intelligence is knowledge about active, real-world threats, malicious domains, URLs, IP addresses, and file hashes that are known to be part of attacks. In an application-security context, it's used to check the things your software touches, an outbound URL, a dependency's download source, an artifact's hash, against feeds of known-bad indicators of compromise (IOCs).
Why it matters#
The other controls in this handbook ask "is this code/config insecure?" Threat intelligence asks a different question: "is this thing known to be malicious right now?" That catches issues the structural checks miss, a dependency that started pointing at a compromised host, a URL in your config that's on a phishing blocklist, an artifact whose hash matches known malware. It's a reputation and freshness signal layered on top of static analysis.
Where it fits#
- Artifact: external indicators referenced by your software, URLs, domains, IPs, file hashes.
- Stage: at scan time as an enrichment, and continuously, reputation changes daily as new threats are discovered.
How it works#
A threat-intel check extracts indicators from your project (or a set of findings) and queries them against one or more feeds, some free and open, some commercial or key-gated. A match raises a high-confidence alert; the value depends heavily on the freshness and quality of the feed.
Popular & reputable sources#
| Source | Notes |
|---|---|
| URLhaus | Free feed of malicious URLs (abuse.ch) |
| VirusTotal | Aggregates many engines; API is key-gated |
| AlienVault OTX | Open threat-exchange community feeds |
| MISP | OSS Malware Information Sharing Platform |
Common pitfalls#
- Feed quality is everything. A stale or low-quality feed produces noise or misses; choose reputable, current sources.
- Rate limits and keys. Commercial feeds (VirusTotal) gate access, plan for API limits and bring-your-own-key.
- It's a signal, not a verdict. A reputation hit warrants investigation, but context still decides the response.
threats control ships today. Enable it on a component's hosts: and Draugr asks whether those hosts are already known to serve malware, abuse.ch URLhaus by default, with VirusTotal available as an opt-in second opinion. Both are bring-your-own-key and normalize to SARIF like every other control.
It answers something no scan of your own endpoint can. A scanner you point at your host checks the paths you know about; this asks whether somebody else has already seen that host serving malware from a path you never deployed. Malware being served now is an error; a host that served it once is a warning, because treating a years-old record as an emergency is how a control gets switched off.
It is also the one control that tells a third party your hosts exist, so it declares that as a
disclosure effect, shown before the scan runs and recorded in the report, and each scanner documents exactly what leaves your machine. Nothing but the hostname does.
Keep learning#
- EPSS & KEV, exploitability signals for known vulnerabilities
- SCA, the dependencies threat intel helps vet