Threat Intelligence and Analysis
Threat Intelligence and Analysis
This domain tests whether you can turn raw reporting and telemetry into a decision someone acts on. Expect questions on the intelligence cycle, the difference between atomic indicators and adversary behaviour, the models used to structure analysis, and the handling rules that govern sharing.
Levels and the intelligence cycle
The cycle runs direction, collection, processing, analysis, dissemination, feedback. Products map to audiences:
- Strategic: adversary intent, sector targeting and business risk; consumed by executives; long horizon.
- Operational: specific campaigns, infrastructure and tooling of a named actor.
- Tactical: how the adversary operates, expressed as ATT&CK techniques such as T1566 phishing or T1071 application layer protocol.
- Technical: atomic IOCs - hashes, domains, IPs, URLs; shortest shelf life and highest false-positive risk.
Models and adversary pain
Diamond Model: every event relates adversary, capability, infrastructure and victim, so a confirmed fact on any vertex lets you pivot to the others. Kill Chain: seven phases from reconnaissance to actions on objective; a strong detection set covers more than one phase. Pyramid of Pain: hashes and IPs are trivial for an adversary to change, while tools, TTPs and the actor themselves are costly to change. Prefer TTP-level detections that survive re-infrastructure.
Standards and handling
STIX 2.1 expresses objects (indicator, malware, threat-actor, relationship) and patterns such as [domain-name:value = 'x.example']; TAXII 2.1 transports them between servers and clients. MISP supports community sharing and correlation. TLP 2.0 (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) governs handling and re-sharing; it is not a severity or confidence rating. Confidence should be stated explicitly, for example with an Admiralty-style source reliability and information credibility pair.
Worked example: a vendor report marked TLP:AMBER says a domain is command-and-control for a group targeting your sector. You grade the source as usually reliable, pivot the domain through passive DNS to find related infrastructure, query internal DNS logs for resolution, and find three hosts. You emit a STIX indicator with valid_from and a 90-day expiry, map the behaviour to T1071.001, and open a hunt for the beaconing pattern. The domain alone is low-pain and will be replaced; the hunt is what persists.
Traps that cost marks: treating an IOC in a report as ground truth; confusing tactical with technical intelligence; re-sharing TLP:AMBER data outside the permitted community; omitting indicator expiry so stale blocks persist; labelling a file hash as an ATT&CK technique.