Summary

Threat intelligence from a telecommunication operator's point of view is a collection of organized, analysed, and refined information about potential and current attacks that may threaten an organization. This information can also include attackers' motivations, intentions, characteristics, and methods, along with their modus operandi or techniques, tactics, and procedures.

In the network and information security area, the occurrence of large-scale and unexpected cybersecurity incidents has triggered the urgent need for threat intelligence. Threat intelligence can help an organization to reduce risk and improve its overall security. A unified taxonomy, grammar, and presentation of threat intelligence has been defined so that threat intelligence can be shared between different organizations.

Recommendation ITU-T X.1217 specifies guidelines for applying threat intelligence in telecommunication network operation after an overview analysis.