Threat Intelligence
debt(d7/e5/b5/t5)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints list tools like nvd, composer-audit, github-advisory, and dependabot, which can catch known CVEs in dependencies — but the broader failure mode (consuming no threat intelligence, not operationalising feeds, reactive-only patching) is invisible in production until exploitation occurs. Automated tools catch a slice of the problem (known CVEs in CI), but the absence of a threat intel programme broadly goes undetected until after a breach.
Closest to 'touches multiple files / significant refactor in one component' (e5). The quick_fix suggests subscribing to PHP security advisories and adding composer audit to CI — a fairly simple starting point. However, the common_mistakes reveal that full remediation requires operationalising threat feeds into SIEM/WAF, filtering by relevance, and establishing continuous subscription processes. This goes beyond a one-line patch and touches CI pipelines, infrastructure tooling, and operational processes across multiple areas.
Closest to 'persistent productivity tax' (b5). Threat intelligence applies to both web and CLI contexts broadly. Establishing and maintaining a threat intel programme imposes an ongoing operational tax — continuous feed management, triage, and operationalisation — that slows multiple workstreams (DevOps, security, incident response). It's not architectural in the b7/b9 sense, but it's also not localised to one component.
Closest to 'notable trap' (t5). The misconception field identifies a well-documented gotcha: teams assume threat intelligence is only for large enterprises with dedicated security teams, and therefore don't adopt even free feeds like MISP or AlienVault OTX. Additionally, common_mistakes show that consuming feeds without operationalising them (not pushing IoCs into SIEM/WAF) is a frequently encountered failure. These are documented, learnable traps rather than catastrophic contradictions of intuition.
Also Known As
TL;DR
Explanation
Threat intelligence transforms raw security data into actionable knowledge: who is attacking, how, with what tools, and to what end. Tactical TI covers indicators of compromise (IOCs) — malicious IPs, domains, file hashes — consumable by firewalls and SIEMs. Operational TI describes attacker campaigns and tooling. Strategic TI informs leadership on threats targeting the industry. Sources include MITRE ATT&CK, CVE/NVD, ISACs, commercial TI platforms, and open-source feeds (AlienVault OTX, Abuse.ch). PHP applications consume TI by integrating IP reputation APIs, blocking known-bad user agents, and scanning logs for IOCs.
Common Misconception
Why It Matters
Common Mistakes
- Consuming threat feeds without operationalising them — indicators of compromise not in your SIEM or WAF.
- Only using free/open-source feeds without commercial feeds for high-value targets.
- Not filtering threat intelligence by relevance to your industry and technology stack.
- Treating threat intelligence as a one-time purchase rather than a continuous subscription.
Code Examples
// Threat intel feed not integrated with defences:
$maliciousIPs = loadThreatFeed(); // 50,000 known bad IPs
// Feed loaded but never checked against incoming traffic
// All 50,000 IPs can still access the application freely
// Integration: add to WAF blocklist or nginx deny list// Consuming threat intel feeds — block known-malicious IPs
$ip = $request->ip();
$feedUrl = 'https://feodotracker.abuse.ch/downloads/ipblocklist.txt';
// Cache locally — don't fetch on every request
$blocklist = Cache::remember('threat_feed_ips', 3600, function() use ($feedUrl) {
$lines = explode("\n", file_get_contents($feedUrl));
return array_filter($lines, fn($l) => $l && $l[0] !== '#');
});
if (in_array($ip, $blocklist, true)) abort(403);
// Other feeds: AlienVault OTX, VirusTotal API, CIRCL.lu
// GitHub Dependabot / Snyk for dependency CVEs
// Subscribe to CERT alerts for your country/sector