Blue-team infosec is all about defending against an opponent. And as we all know, knowing (or “gathering intelligence on” your opponent is becoming crucial: being able to know (and to predict) your opponent’s moves greatly reduces the cost of defending against their attacks. This talk will (re-)introduce the concept of Threat Intelligence as we understand it today, leaving misconceptions behind and exploring the concepts and models that have already been developed to describe it, and see how it relates to “classical” intelligence. Using concrete examples we’ll see exactly how threat intelligence fits in the incident response process, ranging from preparation to lessons learned, and how dismissing it as snake oil can have a negative effect on the defenders. We’ll also expose the some tools and processes that help DFIRers collect, manage, and use threat intelligence today, including their aspirations and limitations.