I85PREP
⌘ K
Cisco CyberOps Professional study materials
Cisco CyberOps Professional study resources

Cisco CyberOps Professional: Threat Analysis and Detection

Cisco CyberOps Professional · Work through your exam, one topic at a time.

All guide sections

Threat Analysis and Detection

Threat Analysis and Detection tests whether you can select, tune, and justify detection logic, analyze vulnerabilities and exploits, and map activity to recognized frameworks. The exam favors reasoning about why a detection works, not memorizing product screens.

Detection types and frameworks

  • Signature-based: Snort/Suricata rules, YARA rules, hash matching. Fast and precise but brittle against polymorphism.
  • Anomaly/baseline: deviation from learned behavior. Powerful but noisy without good baselining.
  • Behavioral/TTP-based: detects technique patterns and survives infrastructure changes.
  • Frameworks: Cyber Kill Chain, MITRE ATT&CK tactics/techniques/sub-techniques, and the Pyramid of Pain (hash, IP, domain, artifacts, tools, TTPs).

Vulnerability and exploit analysis

CVSS base metrics describe intrinsic severity; temporal and environmental metrics adjust for exploit maturity and local context. EPSS estimates exploitation probability, and CISA KEV confirms known exploitation. Exploit availability, reachability, and compensating controls matter more than a raw CVSS 10.0.

Worked example

An alert shows powershell.exe -enc <base64> on a server. Reasoning: encoded commands are behavior, not a hash. Decode the command, inspect the parent process (Office would be suspicious), identify the user, and check for external callbacks. Map to ATT&CK T1059.001 and T1027. If a scheduled admin script explains it, tune an allowlist with context; if it came from a user-writable path and contacts an unknown IP, escalate. A detection keyed only to the encoded string will miss variants.

Traps that cost marks

  • IOC-only detection that dies when infrastructure rotates.
  • Prioritizing CVSS alone while ignoring KEV, EPSS, and asset exposure.
  • Over-broad signatures that create alert fatigue.
  • Confusing a vulnerability with an exploit.
  • Failing to validate detection logic against benign administrative activity.

Key points

  • Signature, anomaly, and behavioral detection trade precision against resilience.
  • The Pyramid of Pain rewards TTP-based detection over hashes and IPs.
  • ATT&CK mapping gives detection coverage a common language.
  • CVSS is intrinsic severity; EPSS and KEV add exploitation context.
  • Tune detections with benign context, not just alert volume.