I85PREP
⌘ K
Cisco CyberOps Professional study materials
Cisco CyberOps Professional study resources

Cisco CyberOps Professional: Threat Hunting and Intelligence

Cisco CyberOps Professional · Work through your exam, one topic at a time.

All guide sections

Threat Hunting and Intelligence

Threat Hunting and Intelligence tests hypothesis-driven hunting and the intelligence lifecycle. Hunting is not alert triage; it is a structured search for activity that existing detections missed. Intelligence supplies context, but it must be evaluated for confidence, timeliness, and relevance.

Hunting method

  • Start with a hypothesis, such as “an adversary is dumping credentials on servers.”
  • Identify required data sources: EDR, Sysmon, DNS, proxy, NetFlow, identity logs.
  • Query, validate findings, and convert successful hunts into detections or new analytics.
  • Frameworks include PEAK (Prepare, Execute, Act, Knowledge), SqRRl, and ATT&CK coverage mapping.

Intelligence method

  • Lifecycle: direction, collection, processing, analysis, dissemination, feedback.
  • Types: strategic, operational, tactical, technical.
  • Standards: STIX 2.x for structured objects, TAXII 2.x for transport, MISP for sharing, OpenIOC for indicators.
  • Sharing controls: TLP markings; respect them.
  • Models: Diamond Model (adversary, infrastructure, capability, victim) and Pyramid of Pain for indicator value.

Worked example

Hypothesis: “Adversary uses credential dumping.” Query Sysmon Event ID 10 (ProcessAccess) where the target is lsass.exe, filter known security tools, and look for unsigned or unusual processes. Pivot to logon events and host telemetry. If confirmed, create a detection, document the TTP, and share at TLP:AMBER with the ISAC. The hypothesis drives the data selection; the finding drives detection engineering.

Traps that cost marks

  • Hunting without a hypothesis, which becomes unfocused fishing.
  • Treating threat intelligence as ground truth without confidence scoring.
  • Ignoring TLP restrictions when sharing.
  • Relying only on IOCs instead of behaviors and TTPs.
  • Failing to convert a successful hunt into a repeatable detection.

Key points

  • Hunting is hypothesis-driven and ends in validation or a new detection.
  • PEAK and SqRRl structure hunting; ATT&CK maps coverage.
  • Intelligence lifecycle: direction through feedback.
  • STIX/TAXII and MISP standardize intelligence exchange.
  • TLP markings govern sharing and must be respected.