I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (ISACA): Threat Intelligence and Indicator Enrichment

CCOA · Work through your exam, one topic at a time.

All guide sections

Threat Intelligence and Indicator Enrichment

This domain tests whether you can turn a raw indicator into an actionable, time-bounded decision - and know when an indicator is too low-fidelity to act on.

Indicator types and their value

  • Hash (prefer SHA-256; MD5 collisions make it weak for identification), IP, domain, URL, JA3/JA3S fingerprint, YARA rule, and TTP-level descriptions mapped to MITRE ATT&CK.
  • The Pyramid of Pain: hashes and IPs are trivially changed by an adversary; behaviors and TTPs are expensive to change. Detection should live as high on the pyramid as you can afford.
  • Every stored indicator needs: value, type, first seen, last seen, confidence, source, TTL/expiry, and context (what malware, which campaign).

Enrichment discipline

  • Pivot techniques: passive DNS to find co-resident domains, WHOIS creation date to spot newly registered infrastructure, certificate transparency for related hostnames, sandbox reports for behavioral context.
  • Sharing formats: STIX 2.1 over TAXII, MISP for community exchange. Deduplicate and score on ingest, not on use.
  • Separate blocking decisions from monitoring decisions. Low-confidence indicators go to watchlists, not to firewall deny rules.

Worked example

An alert fires on outbound traffic to 104.x.x.x; VirusTotal shows 12 of 90 engines flagging it as malicious. Passive DNS shows 4,000 domains resolving to that address and WHOIS places it in a large cloud provider range. Reasoning: shared hosting means the IP is a poor discriminator - blocking it risks breaking legitimate SaaS traffic. Pivot instead to the domain in the TLS SNI, then to the JA3 fingerprint of the session, then to the endpoint process that initiated the connection. Correct output: block or monitor the specific domain, hash, and JA3; monitor the IP; do not block the cloud range.

Traps that cost marks

  • Blocking entire CDN or cloud provider ranges because one hosted IP was flagged.
  • Treating a VirusTotal detection ratio as ground truth rather than one input among several.
  • Storing indicators without first-seen or expiry, so stale data drives alerts a year later.
  • Confusing a phishing URL with the IP that hosts it, or a payload hash with the dropper hash.