If the suppliers of your business are all located in North America, but your supplier web portal suddenly receives a lot of traffic from elsewhere, you should investigate. Therefore, IP geolocation data sounds like threat intelligence to me. However, the term threat intelligence usually refers to file hashes of malware, IP adresses of command&control servers, etc. but not to geolocation data for IP addresses. What do I miss?


"Threat Intelligence" has to have "threat" as a context. A piece of data is just that: data.

The wiki page links to the CERT-UK's paper on the subject and defines threat intelligence as:

[It is] evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.

[quoted from: https://www.gartner.com/doc/2487216/definition-threat-intelligence]

So, just having the geo-location info is the same as having the IP: it's a piece of data. There is no particular relevance to the data, so it is not "threat intelligence". If it was known that major attacks were happening from a particular location (as has happened with Chinese Army attacks coming from known military locations and the IP geo-location data pointed there directly) then that context makes this particular piece of data "threat intel".

Just because the geo-ip data is odd for you in this instance does not make the area of knowledge called "geo-location" threat intel. But I'm not sure why one would require that the data be classified this way.

  • There's some context bound to the question. It is known that only little of legitimate traffic towards the service should normally originate from anywhere except North America. One can treat a lot of traffic coming from elsewhere to be a sign (or, as McMillan puts it, "evidence-based knowledge, including context and indicators, about an emerging menace") of a DDoS threat if they want to. The meaning is vague, the context and the purpose are important. – ximaera Jan 26 '18 at 10:41
  • On the other hand, "major attacks were happening from a particular location (as has happened with Chinese Army attacks coming from known military locations)" – "TI is not simply a list of atomic indicators that an attacker used at one point in time", to quote SANS on this. – ximaera Jan 26 '18 at 10:51
  • @ximaera my comment about major attacks included a current time element (you excluded that from your quotation) meaning that it is not atomic. "Right now, confirmed attacks happening to others from location X." Perfectly fine TI. – schroeder Jan 26 '18 at 11:11
  • @ximaera even if you want to say that IPs from outside a normal range is classified as "bad" (however you want to define 'normal', 'range' or 'bad'), geo-location data is not TI. It with context might be TI to another party ("we are seeing suspicious traffic to our service from these IPs/locations), but to the first party, it's just data. – schroeder Jan 26 '18 at 11:17
  • Fine. It might be reasonable to describe here what SIEM is and how it works, because I believe it fully answers the author's question. Let's see if I'll have enough time for that. – ximaera Jan 26 '18 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.