How do SOCs integrate threat data?

**SIEM** integration: threat intelligence feeds into **SIEM** platforms, enabling correlation with internal events. Known threat indicators in logs trigger alerts; intelligence provides context for investigation.

Automated enrichment: when analysts investigate incidents, systems automatically add threat intelligence context: "This IP is associated with known **phishing** campaign X." Enrichment accelerates investigation.

Hunting support: threat intelligence guides proactive hunting. Analysts search logs for indicators from intelligence feeds, finding threats that didn't trigger automated alerts.