Threat models, structured sharing and evidence-based hunting
Use models for their intended purpose
ATT&CK organizes relevant adversary behavior into tactics and techniques under its published scope. A tactic is not simply a tool name, and a technique mapping is not conclusive attribution. The Diamond Model relates adversary, infrastructure, capability and victim concepts, while a kill-chain model organizes another view of activity. Models can support analysis without proving every incident follows one complete linear sequence or that every listed technique is present.
Separate representation, exchange and detection
STIX provides a structured way to express relevant threat and observable information. TAXII provides supported exchange mechanisms; they are related but not interchangeable names for one data object. A bundle or feed needs actual version compatibility, access rules and meaningful context. MISP can support sharing and correlation within its configured model, but a matched attribute is not automatically malicious. Sigma describes relevant detection logic in a generic rule form; translating it requires the actual backend, data schema and supported field semantics.
Hunt with a falsifiable question
A hunt begins with a testable proposition and the telemetry needed to examine it. Define the population, time, behavior and expected alternatives. A query returning no matches can mean absence of that observed behavior, missing data or an unsuitable analytic; it does not prove the environment is uncompromised. Examine coverage, logging, time alignment and false-positive/negative risks. A positive match is also a starting observation that requires context rather than an instruction to isolate every matching host automatically.
Turn findings into controlled improvements
Record the analysis, relevant source evidence, confidence and actual operational requirement. Detection, enrichment, blocking and incident response have different permissions and service effects. A high-confidence malicious indicator may still require an accountable risk decision before a disruptive block, particularly on shared services. Validate proposed analytics using representative safe evidence and monitor their outcomes. Threat-intelligence and security-operations credentials share genuine foundations, but that does not make every curriculum or practical difficulty identical. No query runs against a real system and no rule, feed, block or attribution claim is published by these written exercises.