The integration of threat intelligence with foundational SIEM capabilities provides additional threat context that can help deliver faster mean time to detect (MTTD) and can ease some of the burden of incident investigation. Threat intelligence feeds typically include malicious: IPs URLs Domain names Email addresses Filenames Hashes Registry keys DLLs