How to Read Threat Intelligence Reports: A Practitioner Extraction Framework

Do not read threat intelligence reports linearly. The executive summary is written for a non-technical audience. Start with the sections that contain machine-actionable content and work outward to context as time permits.

For government advisories (CISA, NSA, FBI joint advisories):

1. IOC section first: IP addresses, domains, file hashes. These are time-sensitive and can be imported into your SIEM within minutes of finding them.
2. ATT&CK technique table or TTP section: This maps to your detection coverage and tells you which detection rules to check or write.
3. Mitigation section: Compare the listed mitigations against your current control state. Each gap is a remediation task.
4. Attribution and campaign history: Read this for context if time permits, but it does not change the detection or mitigation output.

For vendor incident write-ups (CrowdStrike, Mandiant, Palo Alto Unit 42):

1. Initial access method: How did the threat actor get in? This tells you which entry point controls to verify.
2. Persistence mechanism: How did they maintain access? This tells you which detection rules to verify or write.
3. Lateral movement technique: Where did they go after initial access? This tells you which east-west traffic monitoring gaps to close.
4. Data staging and exfiltration: What did they take and how? This informs your DLP and outbound traffic monitoring.
5. IOCs embedded in the report: Often in an appendix or inline as formatted hashes and IPs.

For annual threat landscape reports (Mandiant M-Trends, Verizon DBIR, CrowdStrike Global Threat Report): Skip the report and read the appendix tables. Annual reports are primarily retrospective analysis; the appendix tables contain the actual data (top techniques, vulnerability usage rates, industry targeting statistics) that you can extract in 10 minutes without reading 60 pages.

MITRE ATT&CK technique IDs are the translation layer between a threat intelligence narrative and a security engineering task. When a report says 'the threat actor used living-off-the-land techniques for lateral movement,' that is a narrative description. When it maps to T1021.002 (Remote Services: SMB/Windows Admin Shares), T1569.002 (System Services: Service Execution), and T1078.002 (Valid Accounts: Domain Accounts), those are specific techniques you can look up detection guidance for.

Mapping workflow:

1. Identify technique references in the report: Look for action verbs describing attacker behavior (dumped, executed, exfiltrated, moved, persisted). Each action typically maps to one or more ATT&CK techniques.
2. Look up the ATT&CK technique page for each identified behavior: The technique page includes detection guidance (what data sources and queries to use), mitigation recommendations, and known procedure examples from previous incident reports.
3. Check your current detection coverage: Does your SIEM have a rule for this technique against the relevant data source? If not, the technique page gives you the detection starting point.
4. Build the gap list: Organize unmapped techniques by the data source required for detection. If you are missing coverage because you lack the data source (no PowerShell Script Block Logging enabled, for example), the remediation is enabling the source before writing the rule.

ATT&CK Navigator is a free browser-based tool that lets you import technique lists and visualize coverage gaps against your current detection map. Mark techniques from the report in red; mark your current detections in green. The visual gap map converts a threat intelligence report into a detection engineering sprint backlog.

Indicators of compromise have a time sensitivity that attribution context does not. An IP address used for C2 infrastructure may be rotated within hours of public disclosure. File hashes are more stable but less useful once the malware variant is updated. Domain IOCs have intermediate stability. Extract and ingest IOCs immediately.

Extraction best practices:

Extract programmatically from structured formats: CISA advisories publish IOCs in STIX 2.1 format downloadable from their advisory page. This allows automated ingestion into threat intelligence platforms (MISP, ThreatConnect, OpenCTI) without manual copy-paste. Vendor reports often publish IOCs as a companion CSV or JSON file.

For unstructured reports: Use a tool like iocextract (Python library) or the CyberChef 'Extract IOCs' operation to extract IPs, domains, and hashes from PDF or HTML text. Review the output for false positives (legitimate domains mentioned in the report context, not IOC sections) before ingesting.

SIEM ingestion: Route extracted IOCs to a threat intelligence feed that your SIEM queries for matching against firewall logs, DNS logs, proxy logs, and endpoint telemetry. Most SIEM platforms support a custom threat intelligence table or lookup that is queried in detection rules. Import the IOC list, write a rule that fires when any network or endpoint log entry matches a value in the list.

IOC expiry: Set a maximum IOC lifetime in your SIEM lookup tables. IOCs without confirmed validity after 90 days should be reviewed and either extended or retired. Expired IOCs degrade SIEM performance and generate false confidence.

Not all threat intelligence reports are equally credible. The quality spectrum ranges from primary source reports with verifiable evidence to vendor marketing content that cites other vendors citing other vendors with no original research.

Quality indicators for a high-credibility report:

• Sourcing transparency: Does the report link to primary evidence (malware samples, network captures, government advisories) rather than asserting conclusions?
• Attribution confidence levels: Does the report distinguish between confirmed attribution, probable attribution, and speculative attribution? Reports that present all attribution as certain regardless of evidence quality are lower credibility.
• Technique specificity: Does the report name specific ATT&CK techniques with examples of how the attacker implemented them, or does it describe attacker behavior in vague narrative language?
• Novel content: Does the report describe previously unpublished techniques, IOCs, or campaigns, or is it summarizing content that was in other vendors' reports three weeks earlier?
• Reproducible IOCs: Can the IOCs in the report be cross-referenced against other sources (VirusTotal, Abuse.ch, other advisories) to confirm they are genuinely malicious?

Greenfield signal sources: Government-issued joint advisories (CISA, NSA, FBI, NCSC) carry attribution authority that vendor reports cannot claim. When a government advisory names a specific actor, that attribution has been through intelligence community verification processes. Vendor attribution is valuable as a signal but should be treated as an analytical conclusion, not a government confirmation.