CISP-TRE key terms

A seven-stage model of an intrusion, from reconnaissance through weaponization, delivery, exploitation, installation, command and control, to actions on objectives. Analysts map observed activity to a stage to predict the attacker's next move and choose disruptive controls.

A curated knowledge base of adversary tactics, techniques, and procedures observed in real intrusions, organized by platform. Defenders use its technique identifiers to structure detection coverage, threat hunting hypotheses, and gap assessments.

Three levels of adversary behavior: the tactical goal (why), the technique used to achieve it (how), and the specific implementation details unique to a group or tool. TTPs are more durable intelligence than hashes or domains.

Observable artifacts such as file hashes, domains, IP addresses, or registry keys that suggest a system has been breached. They are easy to share but short-lived, since attackers rotate them frequently.

An analysis framework placing adversary, capability, infrastructure, and victim at four corners of a diamond, with each event connecting them. Pivoting on any corner lets analysts discover related activity and build a fuller campaign picture.

A system that ingests, normalizes, deduplicates, and scores threat data from many feeds, then distributes it to detection tools. It typically stores relationships between indicators, actors, and campaigns for query and correlation.

The process of adding context to a raw observable, such as geolocation, WHOIS history, passive DNS, malware family, or first-seen date. Enrichment turns a bare address into something an analyst can judge and prioritize.

A stated estimate of how much trust to place in a piece of intelligence, often expressed as low, moderate, or high with a source rationale. It helps consumers decide whether to block automatically or merely monitor.

The prioritized questions that guide collection and analysis, derived from decisions the organization must make. Without them, teams collect feeds aimlessly and cannot measure whether intelligence improved any outcome.

A testable statement about attacker behavior that may exist undetected in the environment, for example that a specific credential-theft tool ran recently. A good hypothesis names the data source and the expected evidence.

The practice of recording which adversary techniques existing rules and data sources can actually detect. Mapping exposes blind spots, justifies new telemetry, and prevents teams from assuming coverage they never validated.

Adjusting logic, thresholds, and exclusions so a detection catches malicious behavior while suppressing known benign activity. Tuning is continuous because environments and attacker tooling both change over time.

A vendor-neutral, YAML-based format for describing log detections that can be converted into queries for many SIEM and EDR platforms. It enables sharing detection logic without rewriting it per product.

The structured review of an alert to decide whether it reflects real malicious activity, benign but unusual behavior, or a broken rule. Analysts document the reason so future alerts can be auto-suppressed or reweighted.

Rapidly assessing an alert or incident to assign severity, scope, and ownership before deeper work begins. Effective triage answers what happened, which assets are affected, and whether escalation is warranted.

The repeating phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Each phase has defined deliverables, and lessons learned feed back into preparation.

The chosen method for stopping the spread of an intrusion, such as isolating a host, disabling an account, or segmenting a network. Options trade off speed against evidence preservation and business disruption.

Removing the root cause of an incident, including malware, persistence mechanisms, and compromised credentials, before restoration begins. Skipping thorough eradication usually results in the adversary returning during recovery.

Assigning a standardized level such as critical, high, medium, or low based on business impact, data sensitivity, and confirmed scope. Consistent classification drives escalation paths, notification duties, and resource allocation.

A blameless meeting after resolution that reconstructs the timeline, identifies what worked and failed, and produces tracked improvement actions. Its value depends on honest documentation captured during the incident, not afterward.

Any technique that lets an attacker regain access after reboot or cleanup, such as scheduled tasks, services, registry run keys, or implanted credentials. Hunters enumerate these during eradication to avoid incomplete remediation.

Abusing legitimate built-in tools such as PowerShell, WMI, or certutil to perform malicious actions while blending with normal administration. Detection depends on command-line context rather than file signatures.

Running suspected malware in an instrumented, isolated environment to observe its behavior, including file, registry, process, and network activity. Reports reveal capabilities even when static indicators are obfuscated.

Examining a file without executing it, using strings, headers, imports, entropy, and disassembly to infer purpose. It is safe and fast but can be defeated by packing, obfuscation, or anti-analysis tricks.

Observing a sample while it runs, capturing process creation, file writes, registry changes, and network traffic. It reveals actual behavior but requires isolation and may miss logic that triggers only under specific conditions.

Compressing or encrypting an executable so its real code is hidden until a runtime unpacking stub restores it. High entropy and few readable strings are common hints that a sample is packed.

Recording complete network traffic, including headers and payloads, for later reconstruction and analysis. It provides definitive evidence but demands substantial storage and careful handling of sensitive data.

Summarized connection records containing source, destination, ports, byte counts, and timestamps but no payload. Flows are compact enough for long retention and excel at spotting beaconing and lateral movement patterns.

Identifying regular, automated outbound connections typical of command-and-control implants by analyzing interval consistency, jitter, and destination reputation. Statistical analysis over flow data often surfaces what signature rules miss.

Inspecting captured packet data to reconstruct sessions, extract transferred files, and confirm exactly what occurred on the wire. Analysts use protocol dissectors and stream reassembly to follow conversations across packets.

Traffic that violates a protocol's specification or normal usage pattern, such as malformed headers or commands on unexpected ports. Such deviations can indicate evasion, tunneling, or misconfigured malicious tooling.

Agent software that continuously records endpoint process, file, registry, and network events and supports remote query and containment. It provides the deep telemetry needed to investigate host-level intrusions at scale.

Alerting on patterns of action rather than fixed signatures, such as a document reader spawning a scripting interpreter. It generalizes across malware variants but requires quality telemetry and careful tuning.

Capturing the full arguments of processes launched on a host, often via audit policy or endpoint agents. It exposes living-off-the-land abuse and encoded scripts that file-based telemetry would miss.

Cutting a compromised host off from most network communication while preserving management access for investigation. It limits spread and attacker control but must be paired with evidence collection before or during isolation.

A platform that centralizes logs from many sources, correlates events, and triggers alerts against rules. Its usefulness depends on complete ingestion, accurate time synchronization, and well-maintained detection content.

Security orchestration, automation, and response tooling that runs playbooks to enrich alerts, query systems, and take containment actions. Automation handles repetitive steps so analysts focus on judgment-heavy decisions.

A documented, repeatable procedure for handling a specific alert type, including decision points, required evidence, and escalation criteria. Playbooks make response consistent across analysts and shifts and are the basis for automation.

Desensitization caused by excessive or low-quality alerts, leading analysts to dismiss real threats. It is mitigated through tuning, risk-based alerting, and measuring the ratio of true to false positives.

A documented record of who collected, handled, transferred, and stored evidence, with times and signatures. An unbroken chain supports authenticity in legal or disciplinary proceedings and prevents disputes over tampering.

A bit-for-bit copy of a storage device or partition, verified against the original with a cryptographic hash. Analysis is performed on the copy so the original remains pristine for evidentiary purposes.

Evidence that disappears when power is lost, including memory contents, running processes, network connections, and logged-in sessions. It should be captured first, following an order of volatility.

The assurance that collected evidence has not been altered, demonstrated through hash verification and controlled access. Integrity failures can invalidate findings regardless of how strong the underlying analysis was.

Examining a captured RAM image to recover running processes, injected code, network connections, and encryption keys that never touch disk. It often reveals fileless malware invisible to disk forensics.

Building an ordered sequence of events from logs, file timestamps, and memory artifacts, normalized to a common time zone. A defensible timeline resolves conflicting sources and anchors both response and later reporting.

Mapping fields from diverse log formats into a shared schema so events can be compared and correlated. Without it, queries and detections must be rewritten for every source and cross-source joins fail.

The average elapsed time from alert generation to containment or resolution. It is a core SOC metric that reflects staffing, automation quality, and detection clarity more than raw alert volume.

Assessing which group or sponsor is responsible for an intrusion by comparing TTPs, infrastructure, tooling, and targeting against known activity. Attribution is probabilistic and should always carry a stated confidence level.

The communication path an implant uses to receive instructions and exfiltrate data, often over HTTP, DNS, or encrypted tunnels. Detecting and blocking it severs attacker control even before malware is fully removed.

Tracking how long an indicator remains useful, since IPs and domains are abandoned or repurposed quickly. Consuming stale indicators produces false positives and wastes blocking effort, so feeds should carry expiry guidance.

The legal duty to inform authorities, regulators, or affected individuals about a breach within defined deadlines. Response plans must identify who decides to notify, what evidence supports the decision, and who drafts communications.

A historical record of domain-to-IP resolutions gathered from recursive resolvers and sensors. It links infrastructure over time, exposing shared hosting and reused domains that current lookups alone would hide.