- collecting and analyzing data to understand a threat actor - their motives, targets, and methods https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/