Cyber-threat intelligence data

Cyber defence depends on knowing the threat, and external intelligence is central. This guide covers cyber-threat intelligence data and how to source it effectively.

Available across the EU. DataSupplier sources and delivers this data in all 27 European Union countries — including Germany, France, Spain, Italy, the Netherlands and Poland — and across the EEA, in the format and cadence you need.

Why threat intelligence matters

Defenders cannot see every threat from inside their own walls. External threat intelligence, indicators, vulnerabilities, actor behaviour, provides the context to detect and prioritise, and supports obligations under frameworks like NIS2.

The data landscape

• Indicators of compromise: known malicious signals.
• Vulnerabilities: CVE and exploit data.
• Threat actors: tactics, techniques and procedures.
• Feeds: commercial, open and community sources.

Quality over quantity

Raw indicator feeds are noisy; value comes from relevance, accuracy and context. Too many low-quality indicators create alert fatigue, so curation and enrichment matter more than volume.

Common use cases

Detection and prioritisation, vulnerability management, incident response, and risk and board reporting.

Sourcing considerations

Combine open standards (such as STIX/TAXII feeds), community sharing and commercial intelligence. Provenance and timeliness are critical, and some intelligence carries handling restrictions (traffic-light protocol).

In a managed model

A managed partner can curate and enrich threat feeds into relevant, contextual intelligence delivered to your tools.

Quality over volume

External threat intelligence provides context defenders lack internally, indicators, vulnerabilities, actor TTPs and feeds, but raw indicator volume creates alert fatigue. Relevance, accuracy and context matter more than quantity, so curation and enrichment are key.

Standards and handling

Combine open standards (STIX/TAXII), community sharing and commercial intelligence; provenance and timeliness are critical, and some intelligence carries handling restrictions (traffic-light protocol). This supports detection, vulnerability management and NIS2 obligations.

Sources & further reading

• ENISA and national CSIRTs: threat intelligence.
• MITRE: ATT&CK and CVE.
• OASIS: STIX/TAXII standards.
• EUR-Lex: Directive (EU) 2022/2555 (NIS2).