CTAS cheat sheet

Intelligence is decision-relevant knowledge: data plus context, source evaluation, and analysis; raw indicators without provenance are data, not intelligence.

Requirement types: PIR (priority intelligence requirements) drive collection; SIR (specific) and EEI (essential elements of information) decompose a PIR into answerable sub-questions.

A usable requirement states a decision it supports, a consumer, a deadline, and a resolution criterion; if no decision changes on the answer, it is not a requirement.

Intelligence levels: strategic (policy, resourcing), operational (campaigns, targeting), tactical (TTPs, detection content); each has different time horizons and fidelity needs.

Threat vs. risk: threat is capability and intent to cause harm; risk combines likelihood and impact against an asset or mission; vulnerability alone is not a threat.

Source reliability (A-F) and information credibility (1-6) are scored independently; a reliable source can report unverified information and vice versa.

Intelligence cycle: direction, collection, processing, analysis and production, dissemination, and feedback; feedback re-enters direction to refine requirements.

Data quality dimensions to state explicitly: relevance, timeliness, accuracy, completeness, granularity, and provenance; missing provenance caps confidence.

Collection source classes: OSINT, commercial feeds, ISAC/ISAO sharing, government advisories (e.g., CISA KEV), internal telemetry (EDR, DNS, proxy, identity logs), and human sources.

Collection plan maps each requirement to source, method, frequency, owner, and cost; a source with no mapped requirement is a candidate for retirement.

Indicator expiry is source- and type-dependent: file hashes and domains age out fastest; TTPs and infrastructure patterns persist longer; set TTLs and review dates per feed.

Feed onboarding checks: coverage of your environment, false-positive rate, update cadence, licensing terms, indicator schema, and confidence/provenance fields.

Deduplication and normalization are prerequisites to scoring; the same IoC from multiple feeds is not independent corroboration if the feeds share an upstream provider.

Collection gaps must be documented and risk-accepted rather than silently ignored; a gap register feeds the next requirements cycle.

Source vetting uses historical accuracy, transparency of methodology, latency, and whether the provider discloses corrections and retractions.

Legal and contractual constraints on collection and redistribution (e.g., vendor license limits, PII handling) are recorded at source registration.

Analysis of Competing Hypotheses (ACH): enumerate hypotheses, score evidence as consistent/inconsistent/neutral, and seek evidence that discriminates rather than confirms.

Structured analytic techniques counter bias: key assumptions check, devil's advocacy, red-team, pre-mortem, and what-if analysis; document which were used.

Confidence language and probability language must be defined in a lexicon and used consistently (e.g., 'likely' = 55-80%); avoid mixing the two scales.

Indicators of bias to watch: anchoring on the first feed, confirmation bias, mirror-imaging adversary intent, and availability bias from recent incidents.

Fusion correlates technical telemetry with actor context (infrastructure, tooling, targeting) to move from indicator to behavior; pivoting on shared infrastructure links campaigns.

Diamond Model (adversary, capability, infrastructure, victim) and MITRE ATT&CK mapping convert observations into structured, comparable findings.

Exploitation includes enrichment: WHOIS/passive DNS, certificate transparency, malware family attribution, and geolocation/IP reputation with timestamps.

Every analytic product states source, method, assumptions, confidence, and what would change the assessment (indicators of change).

ATT&CK tactic order is not a required sequence; adversaries skip, repeat, and parallelize tactics, and defense should not assume linear progression.

Kill chain (recon, weaponization, delivery, exploitation, installation, C2, actions on objective) is a defensive model, not an actor's plan.

Initial access vectors: phishing, valid accounts, exploit public-facing apps, supply chain, removable media, and trusted relationships; map each to detection coverage.

Living-off-the-land binaries (LOLBins) and signed tools reduce signature value; behavior-based detection on command lines and parent-child process trees is required.

Persistence mechanisms vary by platform (scheduled tasks, services, registry, cloud IAM roles, OAuth consent); coverage must be assessed per platform.

C2 techniques include beaconing, domain fronting, DNS tunneling, and legitimate cloud services; jitter and sleep patterns are detection features.

Actor profiling distinguishes nation-state, eCrime, hacktivist, and insider by motivation, resources, targeting, and risk tolerance; attribution confidence is separate from impact.

Threat hunting hypotheses derive from ATT&CK gaps and actor TTPs; each hunt defines data sources, expected evidence, and a success criterion before execution.

Product types: tactical alerts (minutes-hours), operational reports (days), strategic assessments (weeks-months); match product to decision cadence.

BLUF (bottom line up front) structure: key judgment, confidence, implications, then supporting detail and sources.

Dissemination channels must respect classification and need-to-know; TLP markings (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) govern onward sharing.

Actionability test: a product names the decision, the owner, the recommended action, and the deadline; otherwise it is background reading.

Feedback loop: track whether the consumer acted, whether the assessment proved correct, and whether the product arrived in time to matter.

Tailor to audience: executives need risk and business impact; SOC needs indicators and detection logic; legal/PR need disclosure and notification triggers.

Machine-readable dissemination (STIX/TAXII, MISP) requires schema conformance and confidence fields so downstream automation can filter.

Intelligence sharing carries risk of exposing sources and methods; sanitize before release and record what was removed and why.

Risk = likelihood x impact; scoring frameworks (e.g., CVSS for vulnerabilities, FAIR for cyber risk) answer different questions and must not be conflated.

Threat landscape assessment ranks actors by capability, intent, opportunity, and relevance to the organization's sector and geography.

Prioritization inputs: asset criticality, exposure, existing controls, adversary interest, and time-to-exploit; a high-CVSS bug on an isolated host may rank low.

Scenario-based assessment (most likely, most dangerous) supports contingency planning and resource allocation.

Strategic warning indicators are leading signals (capability development, doctrine shifts, targeting of peers); they are tracked over time, not one-off.

Risk treatment options: mitigate, transfer, avoid, accept; each accepted risk needs an owner, rationale, and review date.

Sector and peer incident trends inform baseline likelihood; compare your exposure against observed targeting rather than global averages.

Assessment products should state key judgments, confidence, and indicators of change so leadership can monitor shifts between reporting cycles.

Collection and handling must comply with applicable law (e.g., computer fraud, privacy, data protection) and contract terms; legal review precedes new source types.

PII and personal data in intelligence products require minimization, retention limits, and access controls; document lawful basis where required.

Ethical constraints: avoid collecting on protected groups without justification, avoid disproportionate harm, and preserve proportionality and necessity.

Attribution statements carry legal and diplomatic weight; distinguish technical linkage from legal proof and avoid overclaiming in public products.

Sharing agreements define permitted use, redistribution, and attribution requirements; violating them can end sharing relationships.

Governance artifacts: intelligence policy, classification guide, handling rules, acceptable-use policy, and audit logs of access and dissemination.

Incident disclosure obligations (regulatory, contractual, breach notification) are triggered by facts, so intelligence must be accurate and timestamped.

Chain-of-custody and evidence handling matter when intelligence may support legal or disciplinary action; preserve originals and hashes.

Program maturity models (e.g., levels from ad hoc to optimized) assess process, technology, people, and governance; use them to sequence investment.

Metrics categories: production (volume, timeliness), quality (accuracy, false-positive rate), consumption (readership, action taken), and outcome (incidents prevented/detected early).

Avoid vanity metrics (indicator count, feed count); measure whether intelligence changed a decision or improved detection coverage.

Detection coverage measured as ATT&CK technique coverage with validated rules, not rule count; track coverage gaps against priority threats.

Feedback loop: post-incident review compares what intelligence said with what happened, and updates requirements, sources, and detections.

Resource planning includes analyst capacity, tooling/licensing costs, training, and source subscription review cycles.

Service-level targets (e.g., alert triage time, product delivery time) make performance measurable and comparable over time.

Governance cadence: quarterly source review, annual policy review, and periodic tabletop exercises to test dissemination and decision support.

Priority intelligence requirements (PIRs) drive collection and analysis; each PIR must map to a decision, a consumer, and a deadline.

Source reliability and information credibility are scored on separate scales; a reliable source can still report unverified information.

Strategic, operational, and tactical intelligence differ in time horizon and consumer, not in rigor.

Threat (capability and intent) differs from risk (likelihood and impact) and from vulnerability (a weakness).

A collection plan assigns each requirement a source, method, frequency, and owner; unmapped sources are retirement candidates.

Indicator TTLs vary by type: hashes and domains expire fastest, while TTPs persist longer.

Feeds sharing an upstream provider are not independent corroboration of an indicator.

Source vetting weighs historical accuracy, methodology transparency, latency, and correction practices.

Analysis of Competing Hypotheses scores evidence as consistent, inconsistent, or neutral to find discriminating evidence.

Confidence language and probability language use separate, defined lexicons and should not be mixed in one product.

The Diamond Model links adversary, capability, infrastructure, and victim to pivot from indicators to campaigns.

Every product states assumptions, confidence, and indicators of change that would alter the assessment.

ATT&CK tactics are not a required sequence; adversaries skip, repeat, and parallelize them.

Living-off-the-land binaries defeat signature detection, so behavior-based detection on process trees is needed.

Initial access vectors include phishing, valid accounts, public-facing exploits, supply chain, and trusted relationships.

Actor profiling separates motivation and resources from attribution confidence, which is assessed independently.

BLUF structure puts the key judgment and confidence first, then implications, then supporting detail.

TLP markings (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) govern onward sharing and must travel with the product.

An actionable product names the decision, owner, recommended action, and deadline.

Machine-readable sharing via STIX/TAXII or MISP requires schema conformance and confidence fields for filtering.

Risk equals likelihood times impact; CVSS scores vulnerability severity, not business risk.

Actor ranking uses capability, intent, opportunity, and relevance to sector and geography.

Prioritization weighs asset criticality, exposure, controls, and adversary interest, not severity scores alone.

Risk treatment options are mitigate, transfer, avoid, and accept; each accepted risk needs an owner and review date.

Legal review precedes onboarding of new source types, especially those involving personal data.

PII in products requires minimization, retention limits, access controls, and a documented lawful basis where required.

Technical attribution linkage is not legal proof; public statements must avoid overclaiming.

Sharing agreements define permitted use and redistribution, and violations can end the relationship.

Measure outcome metrics (decisions changed, incidents detected early) rather than indicator or feed counts.

Detection coverage is validated ATT&CK technique coverage, not rule count.

Post-incident review compares prior intelligence with what occurred and updates requirements and detections.

Governance cadence includes quarterly source review, annual policy review, and periodic tabletop exercises.