CTI flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Threat Intelligence Definition

Evidence-based knowledge about an adversary - context, mechanisms, indicators, implications, and actionable advice - sufficient to inform decisions about mitigation or response to a threat.

DIKW Chain

Data becomes information through structuring, information becomes knowledge through analysis and context, and knowledge becomes intelligence when tied to a specific decision.

Strategic vs Tactical Intelligence

Strategic intelligence informs executives about risk and investment over long horizons; tactical intelligence gives analysts and SOC concrete indicators and detection details for immediate use.

Actionability Test

Intelligence is actionable only if it is relevant to your assets, timely for the decision window, and specific enough to change a decision or trigger a response.

OSINT

Open-source intelligence derived from publicly available information such as vendor blogs, government advisories, social media, DNS records, and public scanning services.

HUMINT

Human intelligence collected through human sources, including informants, industry peers, closed sharing communities, and analyst conversations with trusted counterparts.

ISAC

Information Sharing and Analysis Center - a sector-based trust group (e.g., FS-ISAC for finance, H-ISAC for health) that shares threat data among members, usually with reciprocal obligations.

Honeypot Collection

Decoy systems deployed to attract adversary activity, producing high-fidelity, low-noise indicators of tooling and behavior targeted at your environment.

MITRE ATT&CK

A knowledge base of adversary tactics, techniques, and procedures based on real observations, used to map detections, plan hunts, and measure defensive coverage.

Cyber Kill Chain

Lockheed Martin's seven-phase model: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.

Diamond Model

An intrusion analysis framework representing each event as Adversary, Capability, Infrastructure, and Victim, with meta-features such as timestamp, phase, result, and direction.

STIX and TAXII

STIX 2.x is a structured language for representing threat intelligence objects and relationships; TAXII 2.x is the HTTPS transport protocol used to exchange STIX between systems.

TLP 2.0 Levels

Four sharing levels: RED (named recipients only), AMBER (limited, organization only; AMBER+STRICT restricts further), GREEN (community-wide), CLEAR (public, no restriction).

Admiralty Code

A grading scheme combining source reliability (A fully reliable to F unreliable) with information credibility (1 confirmed to 6 cannot be judged), e.g., A1 versus C3.

Priority Intelligence Requirements

PIRs are the decision-linked questions that direct collection and analysis; each should name the decision, consumer, timeframe, and required confidence.

Intelligence Cycle

The repeating process of direction and planning, collection, processing, analysis and production, dissemination, and feedback that structures a threat intelligence program.

Collection Plan

A document mapping each intelligence requirement to sources, methods, cost, latency, and gaps, ensuring collection is driven by requirements rather than by available feeds.

Indicator Normalization

Converting collected data into a common schema (such as STIX), removing duplicates, enriching with context, and assigning confidence before storage or distribution.

Sigma Rules

Vendor-neutral, YAML-based detection logic describing suspicious activity, convertible into SIEM query languages such as Splunk SPL, Elastic EQL, or Microsoft KQL.

YARA Rules

Pattern-matching rules using strings and byte sequences to identify and classify malware samples and families during static scanning or sandbox analysis.

Indicator Aging

Applying time-to-live and decay to indicators so stale, volatile data such as old IP addresses does not pollute blocklists or cause false positives.

Analysis of Competing Hypotheses

A structured analytic technique that lists alternative explanations, scores evidence for and against each, and favors the hypothesis with the least disconfirming evidence.

Estimative Language

A defined lexicon expressing analytic probability - for example almost certain, likely, possible, unlikely - used consistently so consumers interpret confidence correctly.

Attribution Confidence

A graded judgment about who conducted an intrusion; infrastructure and tooling overlap suggest but do not prove identity, so attribution must be hedged and sourced.

Intelligence Gap

A question the analyst cannot answer with available collection; gaps are documented in products so consumers understand the limits of the assessment.

TLP Handling Rule

The TLP marking travels with the intelligence product; sharing beyond the permitted level violates trust-group rules and can terminate access to sharing communities.

TIP Integration Path

Threat intelligence platform ingests STIX/TAXII feeds, scores and deduplicates indicators, then pushes them via API to SIEM, EDR, firewall, or SOAR for action.

Machine-Readable Intelligence

Intelligence delivered in structured formats such as STIX JSON or CSV so systems can ingest, enrich, and act on it without manual transcription.

Threat Hunting Definition

Hypothesis-driven, iterative search through networks and endpoints for adversary activity that existing detections missed, distinct from alert triage.

Pyramid of Pain

A ranking of indicator types by attacker cost to change: hash values, IP addresses, domain names, network and host artifacts, tools, and finally TTPs.

Adversary Emulation

Executing known adversary techniques (e.g., Atomic Red Team, CALDERA) in a controlled environment to verify that mapped detections actually fire.

Purple Teaming

A collaborative exercise where offensive emulation and defensive detection validation run together to produce measurable ATT&CK coverage improvements.

CTI Program Maturity

A staged assessment (e.g., CTI-CMM levels one to five) of direction, collection, processing, analysis, dissemination, and feedback capability, from ad hoc to leading.