在威胁情报分析中，'IOC'（Indicator of Compromise）通常指什么？
- 用于评估企业合规等级的审计指标
- 用于识别已发生入侵的技术痕迹或证据 Correct answer.
- 用于描述攻击者动机的心理画像
- 用于预测未来漏洞数量的统计模型
Explanation
IOC 即妥协指标，是能够表明系统或网络已被入侵的可观测痕迹，例如恶意文件哈希、恶意域名、IP 地址或注册表项。它属于事后取证性质的证据，用于检测和关联已发生的攻击活动。
CISP-TRE practice questions
One question at a time. Build your CISP-TRE understanding.
First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
以下哪一项最符合'战略级威胁情报'的特征？
- 用于 SIEM 规则匹配的 YARA 特征串
- 针对单个恶意样本的逆向分析报告
- 面向高层决策者的攻击趋势与风险评估 Correct answer.
- 包含具体恶意 IP 地址的实时黑名单
Explanation
战略级威胁情报面向高层管理者，关注攻击趋势、威胁行为体动向和对业务的整体风险，语言偏重决策支持而非技术细节。它与战术级、运营级情报在受众和抽象层次上不同。
钻石模型（Diamond Model）用于分析入侵活动时，其四个核心顶点不包括以下哪一项？
- 基础设施（Infrastructure）
- 漏洞赏金（Bug Bounty） Correct answer.
- 对手（Adversary）
- 能力（Capability）
Explanation
钻石模型由对手、能力、基础设施和受害者四个顶点构成，用于把入侵事件结构化地关联起来。漏洞赏金是一种安全激励机制，不属于该模型的组成要素。
在 MITRE ATT&CK 框架中，'Tactic'（战术）与 'Technique'（技术）的关系是什么？
- 战术与技术是同一概念的不同命名，可以互换使用
- 战术是攻击者的高层目标，技术是实现该目标的方法 Correct answer.
- 战术是防御方的检测规则，技术是攻击方的规避手段
- 战术是攻击者的具体命令行，技术是其执行结果
Explanation
ATT&CK 中的战术描述攻击者要达到的高层目标，例如持久化或横向移动，而技术描述实现该目标的具体手段。一个战术下通常对应多种技术，二者是目标与方法的层级关系。
关于'威胁情报共享'中的 TLP（Traffic Light Protocol）标记，以下描述正确的是？
- TLP:GREEN 表示信息不得超出原始接收者范围
- TLP:CLEAR 表示信息仅限会议现场口头交流
- TLP:AMBER 表示信息限限于特定组织内部按需知悉 Correct answer.
- TLP:RED 表示信息可自由公开发布
Explanation
TLP:AMBER 限制信息在特定组织或社区内部传播，仅在需要知悉的范围内共享。该标记体系用于帮助情报提供者与接收者就传播边界达成一致。
在情报分析中，'情报需求'（Intelligence Requirement）的主要作用是什么？
- 规定分析人员必须使用的编程语言
- 替代企业现有的全部安全控制措施
- 确定威胁情报产品的销售定价
- 界定需要回答的关键问题以指导收集与分析方向 Correct answer.
Explanation
情报需求明确决策者需要回答的关键问题，从而为收集计划和分析工作提供方向与优先级。没有清晰需求的收集往往产生大量无关数据，浪费分析资源。
以下哪项最准确地描述'威胁狩猎'（Threat Hunting）？
- 定期对全体员工开展钓鱼邮件演练
- 自动封禁所有来自境外的 IP 地址
- 被动等待告警触发后再进行事件响应
- 基于假设主动搜索环境中未被检测到的威胁活动 Correct answer.
Explanation
威胁狩猎是分析人员基于假设或情报线索，主动在环境中搜寻尚未被现有检测手段发现的攻击活动。它强调主动性和假设驱动，而非被动等待告警。
在情报分析中，'来源可靠性'与'信息可信度'通常如何区分？
- 两者都只用于评价技术指标的格式是否规范
- 两者含义相同，都指信息是否最新
- 前者评价信息提供者的可信程度，后者评价信息内容本身的可信程度 Correct answer.
- 前者评价信息内容，后者评价信息提供者
Explanation
来源可靠性关注信息提供者是否可靠、是否有良好历史记录，而信息可信度关注内容本身是否与其他来源一致、是否经过验证。区分二者有助于在评估情报时分别权衡渠道与内容。
某分析员发现一个恶意域名在多个不相关的攻击活动中被使用，最合理的推断是什么？
- 该域名必然由受害者自行注册
- 该域名可能被共享基础设施或第三方服务复用，需进一步关联分析 Correct answer.
- 该域名与攻击活动没有任何关联
- 该域名一定是某个单一攻击者的专属基础设施
Explanation
同一域名出现在多个不相关活动中，可能说明攻击者共用基础设施、使用了被入侵的第三方服务，或存在误报。分析员应结合注册信息、解析历史和上下文进一步验证，而非直接归因。
在分析钓鱼邮件时，以下哪项信息对识别攻击者基础设施最有价值？
- 收件人的职位名称
- 邮件中使用的字体大小
- 邮件头中的 Received 链与发件域认证结果 Correct answer.
- 邮件正文的字数
Explanation
邮件头中的 Received 链可以揭示邮件的实际传输路径，而 SPF、DKIM、DMARC 等认证结果能反映发件域是否被伪造。这些信息有助于追溯发件基础设施并判断欺骗手法。
关于'杀伤链'（Cyber Kill Chain）模型，以下说法正确的是？
- 它只适用于内部人员威胁的分析
- 它按照攻击者从侦察到目标达成的阶段顺序组织攻击行为 Correct answer.
- 它替代了 ATT&CK 框架并废除了战术概念
- 它以防御措施为阶段划分依据
Explanation
杀伤链模型把入侵过程划分为侦察、武器化、投递、利用、安装、命令控制、目标达成等阶段，帮助分析员定位攻击当前所处的环节。它描述的是攻击推进的顺序。
某组织收到一份标注 TLP:AMBER 的威胁情报，其中包含可检测的恶意域名。以下做法最恰当的是？
- 将域名加入内部检测规则，并在需要知悉范围内共享 Correct answer.
- 立即将该情报全文发布到公开博客
- 因标记限制而放弃使用该情报
- 把情报转发给所有外部合作伙伴
Explanation
TLP:AMBER 允许在组织内部按需知悉使用，因此可将域名用于内部检测，同时限制进一步外传。这样既发挥了情报价值，又遵守了共享约定。
在情报分析中，'确认偏误'（Confirmation Bias）会导致什么后果？
- 分析员总是高估对手的技术能力
- 分析员无法访问任何开源情报来源
- 分析员倾向于寻找支持既有假设的证据而忽略反证 Correct answer.
- 分析员过度依赖自动化工具而不做人工判断
Explanation
确认偏误使人偏向收集与既有判断一致的信息，忽视或贬低矛盾证据，从而造成误判。结构化的竞争假设分析等方法可用于缓解此类偏差。
'竞争假设分析'（Analysis of Competing Hypotheses）的核心原则是什么？
- 优先支持最先提出的假设
- 依据情报来源的知名度选择假设
- 评估证据对每个假设的否定程度而非支持程度 Correct answer.
- 只采纳多数分析员同意的结论
Explanation
竞争假设分析强调列出所有可能假设，并评估证据在多大程度上与各假设不一致，倾向于保留最难被证伪的假设。这种方法有助于减少确认偏误。
在恶意软件分析报告中，'TTP' 指的是什么？
- 攻击者的战术、技术与程序 Correct answer.
- 测试、培训与流程
- 工具、流量与协议
- 目标、时间与地点
Explanation
TTP 指 Tactics、Techniques and Procedures，描述攻击者如何实施攻击的行为模式。相比易变的 IOC，TTP 更稳定，对检测和防御设计更有长期价值。
某情报显示某APT组织近期改用合法云服务进行命令控制。分析员应优先采取什么行动？
- 忽略该情报，因为云服务是合法的
- 封禁所有云服务提供商的全部IP段
- 基于行为特征而非仅凭域名检测异常云服务使用 Correct answer.
- 仅依赖已知恶意域名黑名单进行检测
Explanation
攻击者滥用合法云服务时，单纯封禁域名或IP段会产生大量误报并影响业务。应转向检测异常行为，例如非常规时段的云API调用或异常的信标模式。
在情报产品中，'置信度'（Confidence）与'可能性'（Probability）的区别是什么？
- 置信度只用于技术指标，可能性只用于战略报告
- 置信度反映分析员对判断的把握程度，可能性反映事件发生的概率 Correct answer.
- 置信度越高说明事件发生概率必然越高
- 两者完全等价，可以互换使用
Explanation
置信度表达分析员基于证据质量对自身判断的信任程度，而可能性描述事件本身发生的几率。高置信度判断仍可能对应较低的发生概率，二者应分别表述。
以下哪种做法最有助于提高开源情报（OSINT）收集的质量？
- 删除所有与预期结论不符的记录
- 只采集单一社交媒体平台的数据
- 对来源进行交叉验证并记录采集时间 Correct answer.
- 仅依赖匿名论坛的未署名帖子
Explanation
交叉验证可以降低单一来源出错或被操纵的风险，记录采集时间则保证信息可追溯和时效性可评估。这两点共同提升 OSINT 的可靠性。
某样本在沙箱中未表现出恶意行为，但在真实环境中触发了攻击。最可能的原因是什么？
- 真实环境没有安装任何安全软件
- 沙箱环境被恶意软件识别并规避 Correct answer.
- 沙箱与真实环境的操作系统版本完全相同
- 样本文件已损坏无法运行
Explanation
许多恶意软件会检测虚拟化痕迹、调试器或沙箱特征，在识别到分析环境后延迟或抑制恶意行为。这解释了沙箱无行为而真实环境触发攻击的现象。
在威胁情报平台中，'STIX' 与 'TAXII' 的关系是什么？
- 两者都是漏洞评分标准
- STIX 是传输协议，TAXII 是数据模型
- STIX 是数据表达模型，TAXII 是用于交换该数据的传输协议 Correct answer.
- 两者都是恶意软件家族的命名规范
Explanation
STIX 定义了威胁情报对象及其关系的结构化表达方式，TAXII 则定义了在系统之间传输这些情报的协议。二者配合实现情报的标准化表达与交换。
分析员发现某攻击活动的基础设施注册信息与另一活动高度重合，但TTP差异明显。最严谨的结论是什么？
- 应立即公开指认某国家支持该攻击
- 两活动之间绝对没有任何联系
- 两活动必定由同一组织发起
- 可能是基础设施共享或供应商重叠，需结合更多证据判断归因 Correct answer.
Explanation
基础设施重合可能源于共享托管、同一供应商或被入侵资源，而 TTP 差异又提示操作者可能不同。归因需要多源证据支撑，不能仅凭单一维度下结论。
某情报源长期准确，但此次提供的恶意IP与多家厂商数据冲突。分析员应如何处理？
- 因来源历史良好而直接采纳
- 完全弃用该来源今后的所有情报
- 仅在内部邮件中口头传播该IP
- 标记冲突并核查该IP的解析历史与上下文后再定论 Correct answer.
Explanation
来源历史可靠并不保证单条信息正确，冲突提示需要进一步核查，例如解析历史、托管变更和误报可能。保留来源价值的同时对具体结论保持审慎。
在构建检测规则时，为何通常建议优先基于 TTP 而非单一 IOC？
- TTP 更容易被攻击者频繁更换
- TTP 反映行为模式，攻击者改变成本更高且更具持久检测价值 Correct answer.
- IOC 从不发生变化
- IOC 无法被写入任何检测系统
Explanation
IOC 如域名和哈希容易被攻击者快速更换，而 TTP 描述的是攻击者为达成目标所采用的行为方式，改变这些行为往往成本更高。因此基于 TTP 的检测通常更持久。
某分析报告将'高置信度'与'已确认'混用，这在情报写作中为何是问题？
- '已确认'只能用于战略级报告
- 置信度表达分析员把握程度，'已确认'暗示事实已被独立证实，混用会误导决策 Correct answer.
- 置信度只能由情报来源方使用
- 两者都表示同一含义，混用没有影响
Explanation
置信度是对判断可靠性的自我评估，而'已确认'意味着已有独立证据支持该事实。混用会让决策者误以为不确定的判断已被证实，从而高估情报可靠性。
某组织在威胁狩猎中发现异常的凭据访问模式，但无已知恶意软件痕迹。最合理的后续步骤是什么？
- 仅等待下一次自动化告警触发
- 删除相关日志以减少告警噪音
- 围绕该行为构建假设，关联身份日志与网络遥测进行验证 Correct answer.
- 立即宣布事件已解决
Explanation
无恶意软件痕迹但存在异常凭据访问，可能指向凭据窃取或合法工具滥用。应基于假设关联身份认证日志、终端遥测和网络流量，验证是否存在横向移动等活动。
在评估一份威胁情报报告时，分析员发现其中引用的恶意IP地址已被多家安全厂商标记为恶意，但报告未提供该IP的首次发现时间、关联样本或攻击者归属。根据情报分析原则，该报告最可能缺乏以下哪项关键属性？
- 完整性（Completeness） Correct answer.
- 准确性（Accuracy）
- 及时性（Timeliness）
- 可操作性（Actionability）
Explanation
完整性要求情报包含足够上下文以支持决策，如时间、来源、关联实体和影响范围。该报告仅提供IP标记，缺少时间、样本和归属等关键要素，因此完整性不足。及时性关注情报是否在有效期内，准确性关注是否正确，可操作性关注能否直接用于防御，这些并非主要缺失属性。
某企业SOC收到一份TLP:CLEAR的威胁情报，其中包含针对其所在行业的钓鱼攻击TTP描述和恶意域名列表。根据情报共享规范，以下哪种做法最符合TLP:CLEAR的要求？
- 可公开分享，包括在公开博客中引用 Correct answer.
- 仅可向政府监管机构报告
- 可在去除敏感信息后与合作伙伴共享
- 仅限SOC内部使用，不得对外分享
Explanation
TLP:CLEAR表示情报可公开共享，无传播限制。因此组织可以公开引用或发布该情报。TLP:AMBER限制为组织内部及必要知悉者，TLP:GREEN允许社区内共享，TLP:RED仅限指定接收者。
分析员在调查一起入侵事件时，发现攻击者使用了合法远程管理工具（RMM）进行横向移动，且该工具在事件发生前已存在于环境中。以下哪种分析方法最有助于区分正常管理活动与恶意滥用？
- 检查该RMM工具的安装包哈希是否与官方版本一致
- 查询威胁情报平台中该RMM工具是否被标记为恶意
- 扫描网络内所有使用该RMM工具的主机并隔离
- 关联分析该RMM工具的进程创建、网络连接和用户认证日志 Correct answer.
Explanation
合法工具被滥用时，单一指标（如哈希或工具名称）无法区分恶意行为。需要关联进程、网络和认证日志，分析行为链是否偏离基线，例如异常时间、非标准目标或异常账户。其他选项或只检查静态属性，或采取过度反应，或依赖可能无标记的情报。
某情报团队在撰写关于新型勒索软件的评估报告时，希望表达“该勒索软件在接下来六个月内很可能针对医疗行业发动攻击”。根据情报写作规范，以下哪种表述最恰当？
- 该勒索软件可能攻击医疗行业，但尚无证据。
- 有迹象表明该勒索软件可能针对医疗行业，需进一步确认。
- 该勒索软件将攻击医疗行业。
- 我们判断该勒索软件在六个月内针对医疗行业的可能性为高（高置信度）。 Correct answer.
Explanation
情报写作应区分可能性（概率）与置信度（对判断的信心），并使用明确的时间范围和对象。选项B同时给出了可能性高和置信度高，符合规范。其他选项或过于绝对，或模糊不清，或未区分概率与置信度。
某分析员在追踪一个APT组织时，发现该组织近期使用的C2域名均通过同一家注册商注册，且注册邮箱模式相似，但域名解析IP分布在多个不同ASN。以下哪种推断最合理？
- 该组织可能集中管理域名注册，但基础设施托管较为分散。 Correct answer.
- 这些域名属于同一攻击活动，且攻击者未采取任何规避措施。
- 该组织已放弃使用自有基础设施，完全依赖云服务。
- 注册商信息是强指标，可直接用于阻断所有该注册商下的域名。
Explanation
注册商和邮箱模式相似提示域名注册可能由同一实体集中管理，而IP分布在不同ASN表明托管基础设施分散，可能为了规避封锁。这支持“集中注册、分散托管”的推断。其他选项过度推断或忽略风险。
A detection engineer is building a hypothesis-driven hunt. Which statement best describes the role of a threat hunting hypothesis?
- It is a testable statement about adversary behavior that can be validated against telemetry Correct answer.
- It is an automated playbook that remediates confirmed incidents
- It is a fixed list of IOCs that must be blocked at the perimeter
- It is a compliance control mapped to a regulatory framework
Explanation
A hunting hypothesis is a falsifiable proposition about attacker tactics, techniques, or infrastructure that the hunter tests using available data. It guides collection and analysis rather than serving as a static blocklist or remediation workflow.
Which data source is most directly suited to detecting process injection via remote thread creation on Windows endpoints?
- DNS query logs from the recursive resolver
- ETW process and thread telemetry such as Sysmon Event ID 8 Correct answer.
- Proxy logs showing HTTP user-agent strings
- NetFlow records from the core switch
Explanation
Remote thread creation is a host-level event captured by endpoint telemetry such as Sysmon Event ID 8 (CreateRemoteThread) or ETW thread events. Network flow, DNS, and proxy logs lack the process and thread context needed to observe injection.
A hunter wants to identify beaconing behavior in proxy logs. Which analytic approach is most appropriate?
- Comparing file hashes against a known-good baseline
- Listing all destinations resolved by the DNS server
- Measuring the regularity of connection intervals to a destination Correct answer.
- Counting total bytes per user per day
Explanation
Beaconing is characterized by periodic, low-jitter callbacks, so interval regularity (for example jitter analysis of connection timestamps) is the discriminating signal. Aggregate byte counts or DNS listings do not capture timing patterns.
In MITRE ATT&CK, which tactic covers techniques such as process injection and DLL side-loading?
- Exfiltration
- Collection
- Defense Evasion Correct answer.
- Privilege Escalation
Explanation
Process injection and DLL side-loading are mapped primarily to Defense Evasion because they hide malicious code within trusted processes to avoid detection. Privilege Escalation, Collection, and Exfiltration describe different adversary objectives.
A detection rule fires on any PowerShell process with an encoded command parameter. What is the primary weakness of this rule?
- It only works on Linux hosts where PowerShell is uncommon
- It requires network flow data that is unavailable for encrypted traffic
- It cannot be implemented in a SIEM because encoded strings are unparseable
- It will produce high false-positive volume because legitimate management tools also use encoded commands Correct answer.
Explanation
Encoded commands are used by legitimate software deployment and administration tooling, so a rule keyed only on the parameter generates substantial benign noise. Enrichment such as parent process, user context, or decoded content is needed to raise precision.
Which practice best supports reproducible detection engineering across a team?
- Keeping detection rules only in analyst notebooks on local machines
- Documenting rules verbally during shift handover
- Storing detection logic in version control with peer review and change history Correct answer.
- Relying on vendor default signatures without modification
Explanation
Version-controlled detection-as-code enables peer review, rollback, and auditability, which are core to reproducible engineering. Local notebooks, unmodified vendor defaults, and verbal handover lack traceability and consistency.
An analyst observes a spike in SMB connections from many workstations to a single server on port 445. Which hunt hypothesis is most relevant?
- Lateral movement or ransomware propagation via SMB Correct answer.
- Data exfiltration over HTTPS to cloud storage
- Credential dumping from LSASS memory
- Phishing delivery through email attachments
Explanation
Many-to-one SMB fan-in on port 445 is consistent with lateral movement or worm-like ransomware spread across shares. LSASS dumping, HTTPS exfiltration, and phishing delivery produce different telemetry patterns.
Which indicator is most resilient to attacker modification and therefore valuable for long-term hunting?
- An IP address of a phishing server
- A specific malware file hash
- A hard-coded C2 domain name
- A behavioral pattern such as a process spawning a shell Correct answer.
Explanation
Behavioral patterns describe how adversaries operate and persist even when hashes, domains, and IPs are rotated. Atomic indicators are easily changed between campaigns, which limits their durability.
A hunter needs to detect Kerberoasting. Which event pattern is the strongest signal?
- A scheduled task created by the patch management service
- A single account requesting RC4 service tickets for many distinct SPNs in a short window Correct answer.
- A DNS query for a public update repository
- A user logging on interactively to their own workstation
Explanation
Kerberoasting involves requesting service tickets for many service principal names to crack offline, often with RC4 encryption, so a burst of distinct SPN ticket requests from one account is highly indicative. Normal interactive logons and patch tasks do not exhibit that pattern.
What is the main purpose of a detection rule's false positive tuning threshold in a production SIEM?
- To reduce alert volume while preserving detection of the targeted behavior Correct answer.
- To replace the need for log source onboarding
- To encrypt the rule logic so adversaries cannot read it
- To guarantee that no malicious activity is ever missed
Explanation
Thresholds and suppressions balance alert fidelity against analyst capacity, reducing noise while retaining coverage of the behavior of interest. No threshold can guarantee zero misses, and tuning does not replace data onboarding.
During a hunt, an analyst finds that endpoint logs are time-stamped in local time while firewall logs use UTC. What is the most important immediate action?
- Disable the firewall log feed to avoid confusion
- Increase the SIEM storage retention to one year
- Discard the endpoint logs as unreliable
- Normalize timestamps to a common timezone before correlating events Correct answer.
Explanation
Correlation depends on aligned timelines; normalizing to a single timezone (typically UTC) prevents misordered events and false conclusions. Discarding data or disabling feeds destroys evidence rather than resolving the mismatch.
Which technique would a hunter map to the ATT&CK tactic Collection?
- Capturing keystrokes with a keylogger Correct answer.
- Clearing the Windows event log
- Using a proxy to relay traffic
- Creating a scheduled task for persistence
Explanation
Keylogging captures user input, which is data gathering and therefore maps to Collection. Scheduled tasks support Persistence, log clearing supports Defense Evasion, and proxies support Command and Control.
A hunter wants to baseline normal administrative activity before hunting for abuse of remote management tools. Which approach is most sound?
- Block all remote management tools organization-wide immediately
- Build a statistical baseline of who uses which remote tool, from where, and when Correct answer.
- Rely solely on antivirus signatures for remote tools
- Assume all remote management traffic is malicious
Explanation
Behavioral baselining establishes what normal looks like for users, source hosts, and timing so anomalies stand out. Blocking tools outright disrupts operations, and blanket assumptions or signature-only approaches lack context.
Which log source is most useful for detecting DNS tunneling?
- Windows security event log
- Physical badge access logs
- DNS query and response logs with query length and entropy metrics Correct answer.
- Database transaction logs
Explanation
DNS tunneling manifests as anomalous query patterns such as long labels, high entropy subdomains, and unusual record types, which DNS logs capture. Host security logs, badge logs, and database logs do not record DNS payload characteristics.
An alert fires because a signed binary launched from a temp directory spawned a command shell. Which enrichment most improves triage accuracy?
- The binary's digital signature validity and its parent process lineage Correct answer.
- The total number of files in the temp directory
- The user's email mailbox size
- The age of the workstation's operating system image
Explanation
Signature validity and parent lineage distinguish legitimate software behavior from masquerading or side-loading. Directory file counts, mailbox size, and image age do not bear on whether the execution is malicious.
What distinguishes threat hunting from traditional alert-driven monitoring?
- Hunting is performed only after an incident is confirmed
- Hunting only reviews alerts generated by the SIEM
- Hunting depends exclusively on antivirus signature updates
- Hunting proactively tests hypotheses without waiting for a triggered alert Correct answer.
Explanation
Hunting is proactive and hypothesis-driven, seeking undetected adversary activity rather than reacting to predefined alerts. Alert review, signature dependence, and post-incident response describe reactive workflows.
A detection engineer writes a Sigma rule to be portable across SIEM platforms. What is the primary benefit of this format?
- It provides a vendor-neutral rule syntax that can be converted to platform-specific queries Correct answer.
- It automatically blocks malicious IP addresses
- It replaces the need for log field mapping
- It encrypts the rule so it cannot be copied
Explanation
Sigma is a vendor-neutral detection format that can be translated into different query languages, improving portability and reuse. It does not encrypt rules, perform blocking, or eliminate the need for field mapping.
Which combination of events most strongly suggests a pass-the-hash attack?
- NTLM network logon without a preceding interactive logon and with mismatched workstation identity Correct answer.
- A successful Kerberos TGT request during business hours
- A user changing their password through the self-service portal
- A printer spooler service restarting after an update
Explanation
Pass-the-hash reuses captured NTLM material, producing network authentication without a normal interactive logon and often with anomalous source identity. Routine Kerberos TGT requests, password changes, and service restarts do not exhibit that signature.
What is the primary role of a threat intelligence platform in a hunting program?
- Serving as the organization's backup repository
- Aggregating and correlating indicators and context to support hunting and detection Correct answer.
- Managing employee identity provisioning
- Replacing endpoint detection and response agents
Explanation
A TIP consolidates intelligence feeds, enriches indicators with context, and supports matching against telemetry for hunt and detection use. It does not replace EDR, provide backups, or handle identity provisioning.
An analyst wants to reduce alert fatigue from a rule that fires on every failed logon. Which adjustment best preserves detection value?
- Alert only when failed logons exceed a baseline threshold within a window and are followed by a success Correct answer.
- Raise the severity of every failed logon alert
- Disable the rule entirely to eliminate the noise
- Forward failed logon alerts to the help desk queue
Explanation
Thresholding against a baseline and correlating with a subsequent success targets brute-force and password-spray behavior while suppressing isolated failures. Disabling the rule removes coverage, and severity or routing changes do not reduce volume.