Ask most people what “threat intelligence” is and they picture a feed of malicious IP addresses being piped into a firewall. That picture isn’t wrong, but it’s badly incomplete, and the incompleteness is exactly where teams get burned. A block list is one narrow output of one narrow kind of source. The real question underneath any intelligence program is quieter and more uncomfortable: where is your knowledge of the threat actually coming from, and what can’t you see because of where it comes from? Every conclusion an analyst draws is only as good as the raw material feeding it. So before you talk about correlation engines, scoring, or dashboards, you have to talk about sources.
What a “Source” Really Is
A threat intelligence source is any origin of raw or processed data that tells you something about adversaries, their infrastructure, their tools, or their behavior. That’s deliberately broad. A source can be a commercial feed of indicators, a honeypot you run yourself, a Telegram channel a ransomware crew posts to, a colleague at another company, the firewall logs on your own network, or a government advisory. Some sources hand you finished analysis; others hand you a pile of unlabeled observations you have to make sense of yourself.
The key mental shift is that intelligence is derived, not delivered. A list of IoCs (indicators of compromise) is not intelligence — it’s data. It becomes intelligence when it’s collected from a source of known reliability, corroborated, given context, and connected to a decision you actually have to make. The source determines all of that upstream: how timely the data is, how much context comes with it, how trustworthy it is, and how relevant it is to your specific environment.
The Main Families of Sources
It helps to group sources by where they sit, because each family has a characteristic strength and a characteristic blind spot.
- Open-source intelligence (OSINT). Publicly available data: vendor blogs, security researcher write-ups, CERT and CISA advisories, vulnerability databases (NVD/CVE), news, public code repositories, and DNS/WHOIS records. Cheap and broad, but noisy and available to your adversary too.
- Internal / first-party telemetry. Your own logs, EDR alerts, netflow, DNS query logs, authentication events, and honeypots. This is the most underrated source and the most relevant to you specifically, because it describes threats actually touching your environment rather than someone else’s.
- Commercial / closed feeds. Paid providers that aggregate, enrich, and vet indicators and reporting. You pay for curation, context, and coverage you couldn’t build yourself.
- Community and sharing groups. ISACs (sector-specific sharing organizations), trust groups, and platforms like MISP where members exchange indicators and analysis. Highly relevant because peers in your sector face the same adversaries.
- Technical scanning and enrichment sources. Services and tools that catalog internet-facing infrastructure — Shodan, Censys, passive DNS, certificate transparency logs, and malware sandboxes like the public VirusTotal or any-run-style detonation.
- Human and dark-web sources. HUMINT relationships, underground forums, criminal marketplaces, and leak sites. High signal, high effort, and legally and ethically sensitive.
- Government and law-enforcement sharing. National CERTs, sector regulators, and formal programs that distribute advisories and, sometimes, classified or restricted reporting.
A little hands-on collection sits inside several of these families. Enrichment against public infrastructure data is a good example — you can pivot from a single suspicious domain to related infrastructure using ordinary tools:
# WHOIS + passive-DNS-style pivoting on a suspicious domain
whois evil-domain.example
dig +short evil-domain.example A
dig +short evil-domain.example NS
# Reverse-lookup the resolved IP to find co-hosted infrastructure
dig +short -x 203.0.113.45# Query Shodan's API for other services on that host (needs an API key)
curl -s "https://api.shodan.io/shodan/host/203.0.113.45?key=$SHODAN_KEY" \
| jq '.ports, .hostnames, .data[].product'Certificate transparency is another cheap, high-value source for discovering an adversary’s staging domains before they’re used:
# Pull every certificate ever issued for a domain and its subdomains
curl -s "https://crt.sh/?q=%25.evil-domain.example&output=json" \
| jq -r '.[].name_value' | sort -uNone of these commands are intelligence on their own. They’re collection. The value appears when the outputs get tied together and checked against what other sources say.
Why Narrow Sourcing Quietly Cripples You
Here’s the part teams skip. If all your visibility comes from one place, you only see the slice of the threat landscape that place happens to illuminate — and you have no way of knowing how big the dark part is. A program running purely on a single commercial feed will faithfully block yesterday’s known-bad IPs and remain totally blind to a targeted intrusion using fresh infrastructure that nobody has reported yet. A program running purely on internal telemetry sees real attacks against itself but has no early warning about campaigns hitting the rest of its sector this week.
Limited sourcing produces a specific and dangerous failure mode: confident blindness. The dashboard is green, the feed is flowing, everything looks handled — precisely because the tooling can only report on what it can see. You don’t get an alert saying “there is a threat category you have no collection against.” The gap is silent. This is why maturity in an intelligence program is measured less by how much data flows in and more by how many independent vantage points that data comes from.
The Friction You’ll Actually Hit
Adding sources isn’t free, and more sources create their own problems:
- Volume and noise. More feeds mean more indicators, and a large fraction of raw indicators are stale, low-confidence, or irrelevant to your environment. Un-triaged volume drowns analysts and generates false positives that erode trust in the whole program.
- Overlap and false independence. Many “different” feeds quietly resell or rehash the same upstream data. Three sources agreeing means nothing if they all copied one another — you’ve mistaken an echo for corroboration.
- Reliability and freshness vary wildly. An indicator that was malicious last month may host a legitimate service today. Sources differ enormously in how fast they add and, crucially, how fast they retire data.
- Context loss. A bare IP with no notes about the campaign, malware family, or timeframe it relates to is nearly unactionable.
- Format and integration cost. STIX/TAXII, CSV, JSON, proprietary APIs — normalizing heterogeneous sources into one usable store is real engineering work.
- Legal and ethical limits. Dark-web and HUMINT collection carries genuine legal risk and demands guardrails.
Trusting Nothing, Corroborating Everything
The discipline that ties all of this together is all-source analysis: never let a single source drive a consequential decision on its own. Analysts grade sources on reliability (how dependable the origin has historically been) and grade each report on credibility (how plausible this specific claim is), then look for the same finding to appear across genuinely independent vantage points before acting with confidence.
Independence is the load-bearing word. If a domain shows up in a commercial feed, and your own DNS logs show hosts resolving it, and a sector-sharing group flagged it, and certificate transparency shows it was registered days before the activity — that’s four different kinds of evidence converging, and you can act on it. If it merely appears in four feeds that all pull from the same aggregator, you have one data point wearing four costumes. All-source corroboration is also what protects you against deliberate deception: an adversary might poison one source, but poisoning several truly independent ones at once is far harder.
The Takeaway
Threat intelligence is only ever as good as the sources beneath it, and the most important property of a sourcing strategy isn’t volume — it’s diversity of independent perspective. A handful of well-chosen sources spanning open, internal, community, technical, and human vantage points, deliberately corroborated against one another, will beat a firehose of overlapping feeds every time. So the useful questions to keep asking are not “how many feeds do we have?” but “what can’t any of our current sources see, and if a source lied to us, would anything else catch it?” A program that can answer those two questions honestly is one that actually knows where its visibility comes from — and, just as importantly, where it doesn’t.