## 1 Introduction  
Recent and rapid technological advancements have resulted in building smart and complex environments (e.g., smart cities). Among others, smart mobility (i.e., intelligent transport and mobility networks) is an important part of such environments. Smart mobility refers to many modes of transport, with connected and autonomous vehicles (CAVs) being a rising and demanding domain. CAVs aims to assist driving activity by combining various technologies (e.g., advanced sensors, onboard computing, remote processing, telecommunication, and positioning systems) through automated procedures. To accomplish their goal, CAVs collect and analyze data from their surrounding context continuously and navigate within the smart environment with little or no human intervention. CAVs operate on Internet-of-Vehicles (IoV) networks, which are dynamic and multi-diverse ecosystems that include various communication types. Examples of such communication types are Vehicle-to-Vehicle (V2V), Vehicle-to-Infrastructure (V2I), Vehicle-to-Network (V2N), Vehicle-to-Pedestrian (V2P), and Vehicle-to-Everything (V2X). IoV is a challenging domain with complex and diverse features and demands, such as dynamic topological structures, huge network scalability, non-uniform distribution of network components, complex granularities, and mobility limitations [1]. In this context, CAVs are an IoV dimension that attracts diverse types of malicious activities (e.g., cyber-attacks). We identify three main types of such activities: (i) malicious activities on autonomous control systems (e.g., in-vehicle network attacks), (ii) malicious activities on autonomous driving system components (e.g., sensor attacks), and (iii) malicious activities on V2X communications (e.g., attacks on ad-hoc vehicle networks) [2]. Their successful confrontation is critical, considering that vulnerabilities in CAVs can put human life at risk. Researchers have proposed several defense techniques to identify malicious activities [3] and apply response and recovery strategies [4]. During the application of such techniques, information (e.g., characteristics of the detected malicious activity, threat actor profiling, and existing techniques that confront cyber-attacks) is collected and analyzed. Such information is critical for the successful mitigation of potentially harmful activities and incidents in CAVs. The structure of such information should follow standard procedures to be beneficial for security and public safety within a smart environment (e.g., IoV ecosystems). Toward this direction, the cybersecurity community has proposed the use of Cyber Threat Intelligence (CTI) reports. In recent years, CTI has attracted growing attention and investment from cybersecurity communities (both research and industry), considering that cybersecurity stakeholders use CTI to build accessible knowledge repositories, which contain rich information about identified malicious activities, detected cyber-attacks, threat profiling, analysis methods, adversary tactics and techniques, forensics investigation, etc. Cybersecurity stakeholders (e.g., cybersecurity experts) use such knowledge to speed up the analysis process of the detected malicious activities and eventually attribute them successfully, aiming to mitigate their direct impact and prevent similar malicious activities in the future. Focusing on cyber-attacks, recent research works take advantage of artificial intelligence (e.g., machine learning processes) to detect high-level indicators of compromise (IOCs), which are presented in CTI reports, to enable attack attribution [5]. Furthermore, researchers have proposed intelligent systems that model CTI and detect threat types (e.g., anomaly types) on heterogeneous information networks [6]. In an attempt to follow and broaden these strategies, cybersecurity stakeholders could use CTI-based solutions to minimize false alerts, fatigue, and misdetections.