Security Concepts: Frameworks, Intelligence, and Indicators
The Security Concepts domain of 300-220 CBRTHD tests whether you can frame an investigation with adversary models and threat intelligence instead of chasing individual alerts. Items are scenario-based: you are handed an observable, a detection, or a partial timeline and asked which framework explains it, what to pivot on next, or whether an indicator justifies escalation.
The four frameworks worth memorizing cold
- Cyber Kill Chain (Lockheed Martin): reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Use it to name where you can still break the intrusion.
- MITRE ATT&CK: tactics answer why (the adversary's goal), techniques answer how. Sub-techniques (e.g., T1059.001 PowerShell) are what you map detections to. ATT&CK for Enterprise is the relevant matrix here.
- Diamond Model: every event has adversary, capability, infrastructure and victim. Pivoting along an edge (victim to infrastructure, capability to infrastructure) generates new leads.
- Pyramid of Pain: hash, IP, domain, network/host artifact, tool, TTP. Higher tiers cost the adversary more to change, so detections there survive infrastructure rotation.
Turning intelligence into a decision
Cisco Talos supplies reputation to Secure Firewall, Umbrella, Secure Endpoint, Secure Network Analytics and Cisco XDR, so the same observable can carry verdicts in several consoles. Distinguish atomic IOCs (a hash or IP) from behavioral indicators (IOAs, a process lineage, a beaconing pattern). Structured exchange uses STIX over TAXII; every indicator should carry a confidence and an age, because stale indicators and shared-hosting or CDN IPs generate false positives.
Worked example
A proxy log shows a workstation reaching a domain named in a recent Talos write-up. Reasoning: a domain is a mid-pyramid indicator, so reputation alone does not prove compromise. First check whether the domain is shared hosting (passive DNS, many unrelated A records). Then pivot in XDR: does Umbrella show the DNS verdict, and did any endpoint actually resolve the name? If Secure Endpoint shows rundll32.exe spawned by winword.exe minutes before the connection, the chain now spans three telemetries and you escalate to containment, not just blocking. If only the proxy logged the request with no endpoint or DNS corroboration, treat it as a blocked or exploratory hit and monitor.
Traps that cost marks
- Labeling an executed payload as Delivery; execution is Exploitation or later.
- Calling a single IOC match a compromise when no corroborating telemetry exists.
- Assuming a domain verdict is permanent; sinkholed, parked and re-registered domains change meaning.
- Mixing tactic and technique names in attack mapping answers.