Core Cybersecurity Operations and Threat Analysis
Domain 1 tests whether you can turn raw data into an intelligence judgement a SOC can act on: naming the model in use, rating an indicator or vulnerability, and deciding what to share and with whom. Items are scenario-based - a feed entry or a CVSS vector is placed in front of you and you choose the next analytical step.
Intelligence levels
- Strategic - executive risk, sector targeting, no artifacts.
- Operational - a named campaign: who, when, against whom.
- Tactical - adversary TTPs and tooling.
- Technical - atomic artifacts: hashes, domains, IPs, registry keys. A list of C2 IP addresses is technical; a note that an actor phishes finance teams before earnings calls is operational.
Frameworks
- Cyber Kill Chain - seven linear phases from reconnaissance to actions on objectives.
- MITRE ATT&CK - tactics are the why (TA0002 Execution), techniques the how (T1059.001 PowerShell). Not a kill chain and not ordered; one technique can serve several tactics.
- Diamond Model - adversary, capability, infrastructure, victim; use it to pivot across events and cluster them into campaigns.
- Pyramid of Pain - hashes < IPs < domains < host artifacts < tools < TTPs. Detection value rises as you climb; TTP-level detections survive infrastructure rotation.
Scoring and sharing
CVSS v3.1 base score fuses exploitability (attack vector, complexity, privileges, user interaction) with impact (C/I/A). It says nothing about whether the asset matters or whether exploitation is occurring - that is EPSS plus business context. TLP controls redistribution: RED named recipients only, AMBER organisation plus clients, AMBER+STRICT organisation only, GREEN community, CLEAR public. STIX is the data model; TAXII is the transport.
Worked example
A feed lists 198.51.100.23 as C2 for a banking trojan; proxy logs show three hosts beaconing every 60 seconds with 2% jitter. Reasoning: the IP alone is a rotatable, low-value artifact, but periodic beaconing corroborated by external reporting raises confidence, and the underlying technique - application-layer protocol abuse, T1071 - is the durable detection. Action: block at egress, hunt the beacon pattern fleet-wide, and inspect the three hosts for persistence instead of closing the case at the block.
Traps
- Treating an IOC match as confirmed compromise.
- Calling a technique a tactic, or assuming ATT&CK runs in kill-chain order.
- Patching by CVSS alone, ignoring exposure and EPSS.
- Sharing TLP:RED intelligence into a community channel.
- Confusing STIX with TAXII.