Topic starter
11/11/2026 6:02 pm
TL;DR: Relevance depends on the environment, not just the external threat signal, according to Dataminr’s telemetry-driven approach. Analysts need context from assets, controls and identities before they can decide whether to investigate now or deprioritise.
Editorial analysis by NHI Mgmt Group, based on content published by Dataminr: “Inside Dataminr’s Client-Tailored Threat Intelligence: From External Signal to Organizational Relevance”.
Key questions
Q: Why does identity data improve threat intelligence in modern environments?
A: Identity data improves intelligence because access events are often the earliest sign of malicious activity in cloud and SaaS-heavy environments.
Q: How does federated search improve security investigations?
A: Federated search lets an analyst run one query across multiple connected tools, such as SIEM, EDR, cloud logs and ticketing data, without first copying all records into one place.
Q: How do threat intelligence teams decide what is relevant first?
A: Teams decide relevance first by testing whether an external signal intersects with exposed assets, active controls, identity paths and current telemetry.
Practitioner guidance
- Map internal context sources to intelligence workflows Connect SIEM, EDR, vulnerability and identity systems so relevance checks happen before analysts leave the workflow.
- Define relevance criteria for the environment Specify which assets, identities, exposures and alert patterns make an external threat actionable in your organisation.
- Use federated search for first-pass validation Let analysts confirm exposure and prior sightings across connected tools before they open separate investigations.
Bottom line: Threat intelligence becomes useful only when it is filtered through an organisation’s own exposure, telemetry and identity context.
Glossary terms: Threat Intelligence, Indicator Of Compromise, Tactics, Techniques, and Procedures, Federated Search
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
Relevance has become the primary intelligence control: external threat data is no longer scarce, but contextual fit is. Security teams do not need more alerts that say a threat exists; they need intelligence that can determine whether the threat intersects with their own assets, controls and identity paths. That changes threat intelligence from a feed problem into a governance problem, because the unit of value is no longer coverage but decision quality. Practitioners should judge intelligence by how quickly it separates ambient risk from organisation-specific exposure.
A question worth separating out:
Q: What is the difference between severity and relevance in threat intel?
A: Severity is how damaging or urgent a threat or finding is, based on impact, exploitability and exposure. Relevance is how well that intelligence matches your own environment, assets, controls or adversary profile. A high-severity indicator may be irrelevant to your stack, while low-severity intelligence can be highly relevant to a specific exposed service or identity path.
👉 Read our full editorial: Client-tailored threat intelligence improves analyst decision quality