The Threat Intelligence Framework provides the Enterprise Security capability for managing known indicators of compromise and correlating those indicators with observed event data. It is therefore the framework used when engineers want to compare malicious IOCs against telemetry to identify suspicious activity.

Indicators can represent objects such as IP addresses, domains, URLs, file hashes, certificates, or other observable threat artifacts. Enterprise Security processes and normalizes threat intelligence so that matching logic can compare those intelligence objects against compatible fields contained in security events.

For example, a known malicious domain may be compared against DNS or web telemetry, while a malicious IP address may be compared against network connections. A match can subsequently contribute to a finding, risk event, enrichment workflow, or additional investigation depending on the implemented detection strategy.

The Assets & Identities functionality concerns organizational context around entities rather than IOC matching. Incident management handles investigation and response workflows. OSINT describes a category of intelligence collection but is not the Enterprise Security framework requested.

Study Guide topics: Threat Intelligence Framework; IOCs; threat matching; threat-intelligence normalization; event correlation; indicator-based detection.