# What is Threat Intelligence?

*Every cyberattack leaves traces before it strikes. Threat intelligence is the discipline of collecting, analyzing, and acting on those traces — turning raw signals into actionable insights.*

## What is Cyber Threat Intelligence?

*Knowledge that helps organizations stop attacks before they cause damage.*

**Cyber threat intelligence (CTI)** is information about existing or emerging threats that helps security and network teams make faster, better-informed decisions. It answers the fundamental questions: **Who is attacking us? How are they doing it? What are they targeting? What can we do to stop them?**

### IT Administrators

**Network operations & DDI teams**

Understand how threat intelligence integrates at the DNS layer to strengthen everyday network defenses.

**Focus:** Preventive enforcement

### Network Security Teams

**Perimeter & internal defense**

Learn how IoCs and threat feeds combine into layered controls that stop attacks earlier in the kill chain.

**Focus:** Layered defense

### SOC Analysts

**Detection & response**

Turn raw indicators into prioritized, high-confidence detections and faster incident investigations.

**Focus:** Actionable signal

## Why Does Threat Intelligence Matter?

Modern cyberattacks are not random. Threat actors follow patterns, reuse infrastructure, and exploit the same vulnerabilities across multiple targets. Without threat intelligence, you react. With it, you anticipate — and block threats before they reach your endpoints.

1. **Thousands of new malicious domains**  
   Newly registered domains are spun up daily to evade traditional detection and blocklists.  
   *Tag:* Evasion

2. **Rapidly evolving malware**  
   Signatures change constantly to bypass antivirus and static defenses across the enterprise.  
   *Tag:* Polymorphic

3. **Rotating C2 infrastructure**  
   Command-and-control domains rotate rapidly to avoid blocklists and keep infected hosts reachable.  
   *Tag:* C2

4. **Insider & compromised devices**  
   Endpoints silently communicate with attacker infrastructure long before any alarm is raised.  
   *Tag:* Stealth

## How Does Threat Intelligence Work?

Threat intelligence continuously collects data from multiple sources, processes it into structured information, and distributes it to enforcement points across your network — all in real time.

### The Five-Stage Intelligence Loop

From raw telemetry to enforced policy, and back again for continuous improvement.

1. **Data Collection**  
   OSINT, commercial feeds, dark-web monitoring, honeypots, sandboxing, and vendor telemetry.

2. **Processing & Structuring**  
   Raw data normalized into STIX and distributed via TAXII for automated sharing.

3. **Analysis & Scoring**  
   Indicators receive a confidence score. Higher scores trigger more aggressive enforcement.

4. **Distribution & Enforcement**  
   Intelligence pushed to DNS Firewall, endpoint tools, and SIEM platforms as live policies.

5. **Feedback & Improvement**  
   Blocked threats, false positives, and new indicators feed back to improve accuracy.

6. **Continuous Coverage**  
   The loop runs 24×7, adapting policies as new threats and infrastructure emerge.

## What are Indicators of Compromise (IoCs)?

An IoC is forensic evidence suggesting a system may have been breached or is under attack. IoCs are the building blocks of technical threat intelligence — the specific, actionable signals that enforcement tools use to detect and block threats.

### Domain-based IoCs

**Phishing · malware · C2**

Malicious domain names used for phishing, malware distribution, or C2 communication. Every device querying a malicious domain generates a detectable signal at the DNS layer.

**Example:** `login-microsofts.support`

### IP-based IoCs

**Attacker infrastructure**

IP addresses associated with known attacker infrastructure, C2 servers, botnet nodes, or scanning hosts. Blocking these prevents communication with attacker-controlled systems.

**Example:** `185.199.108.153`

### URL-based IoCs

**Payload & exploit URLs**

Specific URLs known to deliver malware, host phishing pages, or redirect victims to exploit kits.

**Example:** `/wp-content/uploads/inv.exe`

**Why IoCs matter at the DNS layer:** DNS is queried by every device before it communicates with anything on the internet. This makes DNS the single most comprehensive visibility point for IoC detection — every malicious domain lookup, C2 callback, and phishing attempt generates a DNS query that can be inspected, flagged, and blocked in real time.

## What are Threat Feeds?

A threat feed is a continuous, real-time stream of IoCs sourced from vendors, research organizations, government agencies, or industry sharing groups — the operational backbone of any threat intelligence program.

### Commercial feeds

Vendors like IBM X-Force, AlienVault OTX, Kaspersky, Cyware, PulseDive, and Sectrio provide professionally curated, continuously updated feeds with confidence scoring.

### Open-source feeds

Community-maintained repositories of IoCs, available freely but with less curation and scoring than commercial sources.

### Custom STIX/TAXII feeds

Private, industry-specific, or partner-distributed feeds that broaden coverage alongside your commercial sources.

### Internal telemetry

DNS query logs, DHCP activity, and endpoint data from your own environment surface IoCs unique to your organization.

**Why multiple feeds matter:** No single feed sees everything. Integrating multiple feeds and cross-validating indicators significantly reduces blind spots and increases confidence.

## What is DNS Threat Intelligence?

DNS threat intelligence applies threat intelligence at the DNS layer, using IoCs, threat feeds, and behavioral analysis to detect, block, and respond to threats the moment a malicious domain is queried.

### Core Capabilities

- **Block before endpoints**  
  Threats stopped at DNS resolution — before any TCP connection is established.

- **Universal coverage**  
  Every device uses DNS. No agents, no gaps — IoT, BYOD, and infrastructure alike.

- **Real-time response**  
  Enforcement decisions at network speed — resolved in milliseconds, per query.

- **Full visibility**  
  DNS query logs give complete forensic visibility into attacker activity across the network.

### Threats Defended Against

1. **Malware C2**  
   Blocks DNS lookups to C2 servers the moment an infected device attempts contact.

2. **Phishing domains**  
   Identifies and blocks domains impersonating legitimate services before users visit them.

3. **DNS tunneling**  
   Detects covert data exfiltration encoded inside DNS queries through anomaly detection.

4. **Domain generation algorithms**  
   AI identifies high-entropy, algorithmically generated domains used by sophisticated malware.

5. **Zero-day & new domains**  
   Preemptively blocks newly registered domains with suspicious behavior profiles.

6. **Data exfiltration**  
   Anomalous DNS query volume or entropy is flagged and quarantined automatically.

## Benefits of Threat Intelligence for Enterprises

Applied at the DNS layer, threat intelligence delivers measurable improvements across prevention, response, visibility, and compliance.

- **Block threats before endpoints**  
  Malicious domains are blocked before any connection is established, stopping malware, phishing, and C2 at the earliest point.

- **Reduce attacker dwell time**  
  Automated quarantine of compromised devices the moment suspicious DNS activity is detected eliminates manual delays.

- **Proactive AI protection**  
  AI-powered anomaly detection identifies DGA activity, DNS tunneling, and enumeration before any feed has cataloged them.

- **Full network visibility**  
  DNS-layer intelligence covers every device — IoT, BYOD, infrastructure — without requiring endpoint agents.

- **Accelerate SOC response**  
  Every event is enriched with device IP, MAC, hostname, VLAN, threat category, and confidence score for faster investigations.

- **Compliance & audit ready**  
  Exportable reports covering blocked domains, affected hosts, and confidence scores, retained up to three years for audits.

## What to Look for in a Threat Intelligence Solution

Use this checklist to compare vendors and validate that the solution you pick can enforce intelligence in real time — not just collect it.

- **Multi-source threat feeds**  
  Broad feed support to eliminate blind spots and cross-validate indicators.

- **Automated confidence scoring**  
  Enforcement decisions made without manual review or ticket queues.

- **DNS-native integration**  
  Enforcement at the earliest point in the attack chain, before any connection.

- **AI behavioral anomaly detection**  
  Beyond static blocklists — catch DGA, tunneling, and enumeration by behavior.

- **Automated response & quarantine**  
  Isolation at DNS and DHCP levels for tamper-resistant containment.

- **False positive management**  
  Trusted whitelists so legitimate business domains resolve normally.

- **Forensic dashboards**  
  Investigation views and exportable reports for every flagged IoC.

- **DNS + DHCP quarantine**  
  Simultaneous enforcement across both layers for complete containment.

## How ManageEngine DDI Central Helps

DDI Central brings together DNS, DHCP, and IP address management in a single platform, applying threat intelligence natively across all three layers for unified containment.

### Multi-Source Threat Feed Integration

DDI Central ships with ManageEngine CloudDNS as its default feed and lets administrators broaden coverage by onboarding threat data from industry-leading vendors like [IBM X-Force, AlienVault OTX, Kaspersky, Cyware, PulseDive, and Sectrio](https://www.manageengine.com/dns-dhcp-ipam/help/dns-security-dns-threat-intelligence-adding-threat-feeds-in-ddi-central.html), alongside any custom STIX/TAXII source — all configured from a single console.

- Native STIX/TAXII protocol support
- Cross-validation across multiple vendors
- Zero manual reconciliation

**Active feeds**

- CloudDNS (default): Enabled
- IBM X-Force: Enabled
- AlienVault OTX: Enabled
- Custom STIX feed: 3 sources

### Automated Custom Confidence Scoring

Every IoC is assigned a vendor-scored confidence rating, and indicators that cross your configured threshold are automatically enforced across all DNS servers via the [DNS Firewall blocklist](https://www.manageengine.com/dns-dhcp-ipam/help/DNS-threat-intelligence-in-DDI-Central.html) — no manual rule-writing or deployment required.

- Configurable enforcement threshold
- Critical threats (90+) isolated instantly
- Continuous scoring updates from vendors

**Score distribution**

- 90—100 · Critical: Auto-isolate
- 50—89 · High: Auto-block
- 30—49 · Suspicious: Monitor

### IoC Investigation Dashboard

Administrators get a unified real-time [threat intelligence dashboard](https://www.manageengine.com/dns-dhcp-ipam/help/threat-intelligence-dashboard-in-DDI-Central.html) that surfaces all DNS-layer activity in one place — total threats, threats per hour, top affected hosts, categories, record type abuse, and confidence-score distribution.

- Every entry hyperlinked for drill-down
- Real-time refresh, per second
- No vendor portal juggling

**Live snapshot**

- Threats last hour: 1,284
- Top affected host: win-fin-04
- Category: Phishing 46%

### AI-Powered Anomaly Detection

Going beyond static blocklists, DDI Central's [anomaly detection engine](https://www.manageengine.com/dns-dhcp-ipam/help/DNS-DHCP-anomaly-detection-in-DDI-Central.html), powered by Zoho's Zia AI alongside a built-in rule library, identifies threats by behavior rather than known signatures — catching DGA activity, DNS tunneling, subdomain enumeration, and DHCP starvation before any feed has classified them.

- Behavior-based, not signature-based
- Real-time [anomaly command center](https://www.manageengine.com/dns-dhcp-ipam/help/DNS-DHCP-anomaly-insights-DDI-Central.html)
- Auto-quarantine on severity

**Anomaly types detected**

- DGA activity: Zia AI
- DNS tunneling: Rule + AI
- DHCP starvation: Rule

### DNS Detection and Response (DDR)

The moment DDI Central observes continuous queries from an internal device to domains in the active threat feed, it triggers automatic isolation through [DNS Detection and Response (DDR)](https://www.manageengine.com/dns-dhcp-ipam/help/DNS-threat-intelligence-investigating-quarantined-endpoints-with-DNS-Detection-and-Response-DNS-DR.html) — enforcing containment via ACL-based DNS blocking, client subnet isolation, DHCP host reservation, and MAC address filtering.

- Zero manual intervention
- Multi-layer enforcement (DNS + DHCP + MAC)
- Full audit trail per quarantined host

**Enforcement layers**

- DNS ACL: Active
- DHCP reservation: Active
- MAC filter: Active

### Trusted Feeds for False Positives

Aggressive threat feeds can sometimes flag legitimate business domains. Administrators retain full override control by marking specific domains as [whitelisted trusted domains](https://www.manageengine.com/dns-dhcp-ipam/help/trusted-feeds.html), ensuring they resolve normally even if they appear in an active blocklist.

- Per-domain override
- Auditable whitelist changes
- No operational disruption

**Whitelist**

- partner-portal.acme.com: Trusted
- internal-svc.corp: Trusted
- Overrides this month: 7

### Forensic Reporting & Compliance

For every flagged IoC, DDI Central generates detailed [filterable threat reports](https://www.manageengine.com/dns-dhcp-ipam/help/threat-intelligence-reports-in-DDI-Central.html), covering hit counts, confidence score history over time, top affected hosts, and threat category breakdowns — exportable as PDF or CSV and retained for up to three years for GDPR, HIPAA, and PCI-DSS audit requirements.

- PDF & CSV export
- 3-year retention
- GDPR · HIPAA · PCI-DSS ready

**Retention & export**

- Retention: 3 years
- Export: PDF · CSV
- Frameworks: GDPR · HIPAA · PCI