Security Threat Intelligence
The curated collection of known threat indicators, attack patterns, and vulnerability data — containing indicators of compromise (IOCs), Common Vulnerabilities and Exposures (CVEs), threat actor profiles, attack technique mappings (MITRE ATT&CK), and the risk scores that contextualize threats to the organization's specific environment.
Why This Object Matters for AI
AI cannot detect sophisticated attacks, prioritize vulnerability patches, or filter phishing attempts without structured threat intelligence; without it, security teams react to alerts without context about whether a detected indicator represents a real threat to their specific environment.
Information Technology & Infrastructure Capacity Profile
Typical CMC levels for information technology & infrastructure in Manufacturing organizations.
CMC Dimension Scenarios
What each CMC level looks like specifically for Security Threat Intelligence. Baseline level is highlighted.
Threat intelligence is whatever security analysts read in news articles or hear at conferences; the organization has no structured collection of threat indicators or vulnerability data.
None — AI has no threat intelligence to reason about.
Subscribe to at least one structured threat feed (CISA alerts, vendor advisories) and maintain a register of known threats relevant to the organization's technology stack.
Security staff manually review vendor advisories and CISA alerts, saving relevant ones to a shared folder — but coverage is inconsistent, and context about relevance to the organization's environment is missing.
Can list documented threats but cannot assess their relevance to the organization's specific infrastructure without environmental context.
Organize threat records with structured fields — threat type, affected products, severity, indicators of compromise — and tag each with applicability to the organization's technology stack.
A threat intelligence register categorizes threats by type, severity, and affected products, but entries lack contextualization — CVE scores are recorded without mapping to which internal systems are affected.
Can filter threats by severity and affected product but cannot determine which internal systems are exposed without manual asset cross-referencing.
Link threat records to the internal asset inventory and vulnerability scan results so each threat is contextualized against the organization's actual exposure.
Threat intelligence records include IOCs, CVE mappings, MITRE ATT&CK techniques, and risk scores contextualized against the organization's asset inventory and vulnerability scan results.
Can prioritize threats based on actual organizational exposure, correlate IOCs with network activity, and recommend patching priorities.
Enforce a validated threat schema with automated enrichment from multiple feeds, standardized scoring models, and machine-readable indicator formats (STIX/TAXII).
A validated threat schema ingests from multiple feeds in STIX format, auto-enriches indicators with organizational context, and produces risk scores weighted by asset criticality and exploit availability.
Can auto-correlate threat indicators with security events, predict attack likelihood based on exposure analysis, and generate actionable response playbooks.
Deploy real-time threat intelligence streaming from global feeds, dark web monitoring, and industry ISACs that updates risk scores continuously.
Real-time threat intelligence streams from global feeds, dark web monitoring, and industry ISACs continuously update risk scores, correlate with live security telemetry, and trigger automated responses.
Can autonomously detect emerging threats, correlate with organizational exposure, and trigger defensive actions before attacks materialize.
Ceiling of the CMC framework for this dimension.
Capabilities That Depend on Security Threat Intelligence
Other Objects in Information Technology & Infrastructure
Related business objects in the same function area.
IT Asset Inventory
EntityThe comprehensive registry of all IT assets — servers, workstations, network devices, cloud instances, and installed software including hardware specifications, operating system versions, patch levels, warranty status, assigned owner, and the relationships between assets that form the configuration management database (CMDB).
IT Service Ticket
EntityThe transactional record for each IT incident or service request — containing the reported issue, affected system, priority, category, assigned technician, resolution steps taken, time to resolution, root cause code, and user satisfaction rating tracked through the ITSM lifecycle.
Network and Infrastructure Topology
EntityThe structured map of how IT systems interconnect — defining network segments, VLANs, firewall zones, cloud VPCs, load balancer configurations, DNS records, and the dependency chains that show which applications rely on which infrastructure components.
User Identity and Access Profile
EntityThe managed record of each user's digital identity — containing authentication credentials, role assignments, group memberships, application entitlements, access request history, last login timestamps, and the privilege escalation audit trail maintained by identity and access management (IAM) systems.
Software License Portfolio
EntityThe managed inventory of software entitlements — containing license types (perpetual, subscription, usage-based), quantities purchased, quantities deployed, renewal dates, cost per license, vendor contract references, and the compliance position showing over- or under-deployment per product.
Patch Deployment Priority Decision
DecisionThe recurring judgment point where IT operations evaluates which patches to deploy and in what order — weighing vulnerability severity (CVSS score), exploit availability, asset criticality, production impact risk, maintenance window constraints, and testing completion status.
Security Incident Response Decision
DecisionThe recurring judgment point where the security team determines the appropriate response to a detected threat — evaluating threat severity, confidence level, affected systems, containment options (isolate, block, quarantine), business impact of each response action, and the escalation criteria for invoking incident response plans.
Configuration Baseline Rule
RuleThe codified standard configurations for each asset class — defining approved OS versions, required security settings, mandatory agents, network configurations, and hardening standards (CIS benchmarks, STIG) that every system must comply with, along with the exception process for justified deviations.
Access Control Policy Rule
RuleThe codified rules governing who may access which systems under what conditions — defining role-based access templates, separation-of-duties constraints, privileged access requirements (MFA, just-in-time), periodic review schedules, and the automatic deprovisioning triggers for terminated or transferred employees.
IT Incident Management Process
ProcessThe end-to-end workflow governing how IT incidents are detected, triaged, escalated, resolved, and reviewed — defining severity classification criteria, response time SLAs per severity, escalation paths, communication templates, post-incident review requirements, and the knowledge base update triggers that capture resolution patterns.
What Can Your Organization Deploy?
Enter your context profile or request an assessment to see which capabilities your infrastructure supports.