John, a threat analyst at GreenTech Solutions, wants to gather information about specific threats against the organization. He started collecting information from various sources, such as humans, social media, chat room, and so on, and created a report that contains malicious activity. Which of the following types of threat intelligence did he use?

The analyst is engaging in Operational Threat Intelligence. This level of intelligence focuses on understanding the specifics of impending attacks or campaigns from known adversaries. By collecting information from human sources (HUMINT), social media, and chat rooms about malicious activity targeting the organization, the analyst is gathering insights into a threat actor's intent, capabilities, and plans. This type of intelligence is highly specific and actionable for network defenders to prepare for and respond to targeted attacks.

A. Strategic Threat Intelligence: This is high-level intelligence for executives about broad trends and business risks, not specific, ongoing malicious activity.
B. Technical Threat Intelligence: This focuses on specific indicators of compromise (IoCs) like IP addresses or file hashes, not the broader context of an actor's plans.
C. Tactical Threat Intelligence: This focuses on the general Tactics, Techniques, and Procedures (TTPs) of adversaries, which is less specific than intelligence about a particular impending attack.

1. Contos, B. T., & Wilkens, D. (2015). Physical and Logical Security Convergence. Elsevier. Chapter 6, "Threat Intelligence," defines Operational Intelligence as providing "highly technical, specific details about a past, present, or forecast cyberattack" and focusing on the "who, what, where, and when" of a specific threat.

2. NIST Special Publication 800-150, Guide to Cyber Threat Information Sharing. Section 2.2.2 discusses different types of cyber threat intelligence. It describes operational intelligence as providing "information on a specific incoming attack" and being useful in "identifying, stopping, and eradicating the attacker."

3. Tounsi, W., & Rais, H. (2018). A survey on technical threat intelligence for security operation center. Computers & Security, 72, 212-234. https://doi.org/10.1016/j.cose.2017.09.002. The paper distinguishes between strategic, tactical, and operational intelligence, aligning the scenario's activities with the operational level.