Threat-intelligence records are structured entries that organize observations about malicious activity. Depending on the source, a record may describe an attacker’s claim, a suspected victim, dates, indicators such as domains or file hashes, and the source and confidence level of each detail. They help analysts connect related activity and share information in a consistent format.
In cyber security, these records support threat monitoring, incident response, and risk assessment-but they do not make an unverified claim true. For example, a leak-site listing may be recorded as an alleged victim disclosure while investigators separately verify whether files are authentic and whether an intrusion occurred. Defenders should track provenance and confidence, distinguish claims from confirmed facts, and update or correct records as evidence changes.