How often should threat intelligence reports be produced?

Strategic reports quarterly, operational reports monthly or per significant campaign, and tactical IOC feeds in real-time. The cadence depends on your organization size and threat landscape. Consistency matters more than frequency.

What makes a good threat intelligence report?

Actionability. Every report should answer the question "so what do we do about this?" If a reader finishes the report without a clear action item, the report failed. Include specific detection rules, hunt queries, or mitigation steps.

Should we buy commercial threat intelligence or build our own?

Most organizations need both. Commercial feeds provide broad coverage and timely IOCs. Internal intelligence provides context about threats specific to your industry, assets, and adversaries. Start with commercial feeds and build organic capability over time.

How do we share intelligence without revealing sensitive information?

Use the Traffic Light Protocol (TLP) to classify what can be shared and with whom. Strip victim-specific information and sensitive collection methods. Share IOCs and TTPs rather than raw investigation details. Use STIX/TAXII for automated, structured sharing.

How do we measure the value of threat intelligence?

Track intelligence-driven detections, hunts, and blocked attacks. Measure how often intelligence leads to proactive control improvements. Survey consumers on whether reports are useful and actionable. A single prevented breach can justify the entire intelligence investment.

What is a cyber threat intelligence (CTI) report?

A CTI report is a written assessment of a threat actor, campaign or vulnerability with indicators, ATT&CK-mapped behaviour, confidence levels and recommended actions for a stated audience.

What should a sample threat intelligence report include?

A marking (TLP), a bottom-line summary, key judgments with confidence, actor and campaign detail, indicators, detections, recommended actions with owners, and a list of gaps and sources.

What is the difference between a threat hunting report and a CTI report?

A CTI report assesses a threat from available data. A threat hunting report documents a hypothesis tested in your own environment, what was found and the detections created.

Which format should indicators use?

Include a readable table and a machine-readable export. STIX with TAXII is the common open standard for structured sharing.

Threat Intelligence Report Template

What is a threat intelligence report?

A threat intelligence report turns raw threat data into a decision: who is targeting you, how they operate (mapped to MITRE ATT&CK), which indicators to block, and what to do next. A usable report states its audience, confidence level and sharing marking, and ends with specific actions rather than general findings.

Overview

Threat intelligence only has value when it leads to action. A well-structured intelligence report translates raw threat data into decisions: which detection rules to deploy, which vulnerabilities to prioritize, which attack scenarios to prepare for. This template helps you produce consistent, actionable threat intelligence reports that your SOC, leadership, and partner teams can actually use, not just read and file away.

Report Sections

Executive summary: key findings and recommended actions in plain language
Threat actor profile: attribution, motivation, known campaigns, and target sectors
Tactics, techniques, and procedures (TTPs): MITRE ATT&CK mapping
Indicators of compromise: IPs, domains, hashes, URLs, email addresses
Attack chain analysis: step-by-step reconstruction of the threat activity
Detection and mitigation recommendations: specific controls and rules
Intelligence gaps: what we do not know and what we need to investigate further
Confidence assessment: reliability of sources and analytical confidence level

A report works as a dossier: summary first, evidence behind it.

Intelligence Classification

Level	Audience	Content focus	Update frequency
Strategic	CISO, Board, Executives	Threat landscape trends, risk to business objectives, industry targeting	Quarterly
Operational	SOC Manager, IR Lead	Campaign details, threat actor profiles, attack patterns	Monthly or per campaign
Tactical	SOC Analysts, Detection Engineers	IOCs, detection rules, hunt queries, signatures	Weekly or real-time
Technical	Malware Analysts, Forensics	Malware samples, exploit code, infrastructure analysis	Per investigation

Writing for Different Audiences

The same threat information needs to be packaged differently depending on who is reading it. The CISO wants to know how this threat affects business risk and what investment is needed. The SOC manager wants to know which detection gaps to close and whether the team needs additional resources. The analyst wants IOCs they can load into their tools in the next five minutes. Write each section for its audience. Lead the executive summary with business impact, not technical details. Include IOCs in a machine-readable format alongside the narrative.

One intelligence finding packaged for executive, SOC manager and analyst audiences — Same finding, three packages for three readers.

Confidence and Source Assessment

Rate the confidence of each finding using a standard framework like the Admiralty system or a simple High/Medium/Low scale. A high-confidence finding is based on multiple independent, reliable sources. A low-confidence finding may be based on a single unverified report or speculative analysis. Document your sources without compromising sensitive collection methods. Be transparent about what you know versus what you assess. Intelligence consumers make better decisions when they understand the reliability of the information they are acting on.

Operationalizing Intelligence

Convert IOCs into SIEM detection rules and EDR watchlists within hours of report publication
Map TTPs to MITRE ATT&CK and identify gaps in your defensive coverage
Brief the SOC team during shift handovers on active threats from the latest reports
Feed intelligence into threat hunting hypotheses for proactive investigation
Share anonymized findings with your ISAC and trusted peers for collective defense
Track whether intelligence-driven actions prevented or detected actual threats

Flow from intelligence report to detection rules, hunts and SOC briefings — Intelligence earns its keep when it becomes a rule, a hunt or a briefing.

Sample Threat Intelligence Report Structure

1
Title and marking
Name the threat, date, author and a TLP marking so readers know how far it can travel.
2
Bottom line up front
One short paragraph on impact and the decision needed, written for the executive reader.
3
Key judgments
Three to five assessed statements, each with a confidence level.
4
Threat actor and campaign
Who, why and what they target, with ATT&CK technique IDs.
5
Indicators and detections
IOCs in a machine-readable table plus the detection rule or hunt query to use.
6
Recommended actions
Owner, action and deadline for each item.
7
Gaps and sources
What you do not know and how reliable each source is.

Threat Intelligence Report Example: Fields to Fill In

Field	Example entry (illustrative)	Why it matters
TLP	TLP:AMBER	Controls onward sharing
Confidence	Moderate	Sets how hard to act
Technique	T1566 Phishing	Maps to detection coverage
Indicator	Domain, hash or IP with first-seen date	Loads into SIEM or EDR
Action	Block, hunt, or patch; owner and due date	Turns reading into response

Cyber Threat Intelligence Report vs Threat Hunting Report

Report	Starts from	Output	Reader
CTI report	External or internal threat data	Assessment of actor, campaign and risk	CISO, SOC lead, detection team
Threat hunting report	A hypothesis tested in your own data	Findings, new detections and coverage gaps	SOC and detection engineering

Sources and verification

Regulatory statements on this page were checked against the official sources below on 2026-10-09. Programs and rules change, so confirm against the source before you rely on a date or requirement.

Threat hunting playbookTurn reports into hypotheses.SOC shift handover templateBrief active threats at handover.Detection engineering guideConvert indicators into rules.Phishing analysis playbookAnalyse a common campaign type.Incident report post-mortem templateWrite up what happened.Threat intelligence solutionExternal threat monitoring.