## 2 Cyber Threat Intelligence and Active Buildings  
Threat intelligence is knowledge collected with the purpose of responding to incidents due to malicious adversaries (our focus), hazards, or faults. Thus, such knowledge includes context, mechanisms, technologies, entities, campaigns and mitigations that can be used by security experts to avoid or respond to similar incidents in the future. It has been long observed that data, information, knowledge, intelligence, and wisdom are interrelated concepts that play a crucial role toward an effective system analysis [31]. Recent advances introduced the terminology _cyber threat intelligence_ (CTI) [19; 32] to encompass information technologies.  
In the real world, CTI holds value to enterprises wishing to enlarge the analysis scope when considering cyber-attacks. We mention the SANS Institute (SANS is a US institute and the acronym stands for SysAdmin, Audit, Network, and Security.) report tackling how it is employed by organisations [33]. They noticed an increase in interest over the years; however, stakeholders comment on the need of expanding use cases to enhance how to understand the CTI benefit and security posture gains. The analysis also discussed on the need for improving report automation and ways of enlarging adoption by government-sponsored groups, private sector, and industry-focused groups, to name a few of their findings.  
CTI does not enjoy a solid, established, standardised, or recognised format to store intelligence. Examples of data sources [33] combine technical, human, and internal domains, and the knowledge could be both structured and unstructured [19; 34]. This naturally raises concerns about the _quality_ of CTI-based feeds: indeed, it is a topic of wide interest [35; 36]; [PERSON] et al. [37], for instance, investigated automated assessment of sources and computed a relevance score index to reduce the time needed to verify gathered intelligence. Another task on the same line is that of assessing and evaluating data made available from various sources: open (publicly available) CTI feeds, data from security vendors, industry reports on vulnerabilities, open-source intelligence (OSINT) reports [38], security data extracted from IDS or firewall, data from the security, information, and event management (SIEM) platform, incident response systems, and network traffic and flow logs, to mention a few. [PERSON] et al. [39] conducted a comparative analysis of threat intelligence sources, highlighting structured standards such as STIX [29], Trusted Automated Exchange of Indicator Information (TAXIITM) [40], and Cyber Observable eXpression (CybOXTM) [41; 42].  
CTI is undoubtedly a valuable instrument for the protection of cyber-physical systems [19]. A complex CPS can comprise many devices, interlinked through either power or communication lines, or both and in manifolds, e.g., an IoT device can be connected to the power line as well as to the Internet through a cable, a WiFi, and a mobile data connection. The more elements constitute a CPS, the bigger is its attack surface exposed to cyber attacks, and that translates to a higher amount of information collected as CTI. One example of such complex system is active buildings.