A threat intelligence platform is software that collects information about known attackers and their tools, and checks it against what is happening inside a company. Threat intelligence means information about attacker groups: who they are, which internet addresses and tools they use, and which kinds of companies they attack.
This information arrives as feeds. A feed is a list that a security company or a government agency updates every few minutes or hours. In India, CERT-In, the government's cyber security agency, also publishes warnings about attacks that are happening now. A feed contains indicators. An indicator is a small fact that points to an attacker, such as an internet address, a website name, or the hash of a harmful file. A hash is a short code calculated from a file's contents. Two copies of the same file always have the same hash, so the hash identifies the file.
The platform collects many feeds and removes duplicates. It scores each indicator for how reliable it is. Then it sends the indicators to the tools that can use them. The SIEM searches its logs for them. The firewall blocks connections to the attackers' addresses.
Consider an electricity distribution company in Jaipur. At 11 a.m., a feed warns that an attacker group is targeting Indian power companies. The feed lists five internet addresses and the hash of one harmful file. Within minutes, the platform sends the five addresses to the firewall, which starts blocking them. It also asks the SIEM to search the last 180 days of logs for them. The search finds one laptop in the billing office that connected to one of the addresses two weeks ago. The analysts now know which laptop to examine.
The platform also answers single questions. During a response, a SOAR playbook can ask it whether one address or website belongs to a known attacker.
Some intelligence is about weaknesses in software rather than about attackers. A publicly listed security flaw is called a CVE. When attackers start using a CVE, vulnerability intelligence tells the team which of its systems to fix first. Some intelligence comes from news and social media, which is called open-source intelligence (OSINT). And some comes from criminal forums, where stolen passwords are sold. This is collected by dark-web monitoring.