CTI key terms

Evidence-based knowledge about existing or emerging hazards to assets, including context, mechanisms, indicators, implications, and actionable advice, that informs decisions about how to respond.

Finished intelligence specific enough, timely enough, and contextualized enough that a named decision-maker can act on it directly, rather than merely reading it as background.

A hierarchy in which raw observations become information once organized, and become intelligence only after analysis adds meaning, context, and relevance to a decision.

Written statements of the specific questions decision-makers need answered, prioritized so collection and analysis focus on what matters rather than on whatever data is easiest to obtain.

The small set of highest-priority questions about adversaries, threats, or the environment that a team formally tracks; everything else is secondary to answering these.

The recurring process of planning and direction, collection, processing, analysis and production, dissemination, and feedback that turns requirements into delivered intelligence.

The first phase of the intelligence cycle, in which stakeholders set requirements, assign priorities, allocate resources, and define what finished products must answer.

The phase in which data is gathered from sources such as internal telemetry, OSINT, commercial feeds, malware analysis, and partner sharing, guided by stated requirements.

A document mapping each intelligence requirement to the sources, methods, owners, and cadence that will satisfy it, exposing gaps where no source currently exists.

Converting collected raw data into consistent, deduplicated, machine-usable form, for example parsing logs, translating formats, and mapping indicators to a common schema.

Adding context to an observable, such as geolocation, WHOIS history, malware family, or campaign attribution, so an analyst can judge its meaning and significance.

The phase in which processed data is interpreted, tested against alternative explanations, and turned into assessments and products that answer the stated requirements.

The disciplined work of interpreting information, weighing source reliability, testing hypotheses, and producing judgments that explain what is happening and what it likely means.

Formal methods such as key assumptions check, analysis of competing hypotheses, and devil's advocacy used to surface bias and make reasoning auditable and repeatable.

A technique that lists plausible explanations, then evaluates each piece of evidence for consistency with every hypothesis, favoring the explanation with the least disconfirming evidence.

An explicit statement of how strongly evidence supports a judgment, often expressed as low, moderate, or high, kept separate from the likelihood that the event will occur.

A source-rating scheme pairing a letter for source reliability with a number for information credibility, helping analysts weigh reporting before it influences a judgment.

Systematic errors in judgment such as confirmation bias, anchoring, and mirror-imaging that lead analysts to overvalue convenient evidence and underweight inconvenient facts.

Observable artifacts such as file hashes, domains, IP addresses, or registry keys that suggest a system has been breached; they are easily changed by adversaries.

Evidence of adversary behavior or intent during an intrusion, such as unusual command execution or lateral movement patterns, which is harder for an attacker to alter than static artifacts.

A measurable event or state, such as an IP connection or file creation, that may or may not be malicious; it becomes an indicator only when given meaning and context.

A layered description of adversary behavior: the high-level goals (tactics), the general methods used (techniques), and the specific implementations observed (procedures).

A publicly maintained knowledge base of adversary tactics and techniques organized by platform and observed in real intrusions, widely used to map detection coverage and hunting hypotheses.

A seven-stage model of an intrusion from reconnaissance through actions on objective, useful for identifying where in an attack lifecycle a defender can interrupt the adversary.

A framework relating adversary, capability, infrastructure, and victim around a central event, used to pivot between related observables and to structure campaign analysis.

A labeling convention (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) that tells recipients how widely shared information may be redistributed, defined in the FIRST standards.

An OASIS standard, expressed in JSON, for representing cyber threat intelligence such as indicators, observed data, campaigns, and relationships in a machine-readable, shareable form.

An OASIS standard defining how threat intelligence is exchanged over HTTPS using collections and channels, commonly transporting STIX content between sharing partners.

Long-horizon intelligence about adversary intent, geopolitics, and sector risk, written for executives and used to shape risk appetite, investment, and policy decisions.

Intelligence about specific campaigns, actors, and their capabilities and intent, used by security managers to plan defenses and prioritize responses to imminent activity.

Short-lived, technical intelligence such as indicators and tooling details that supports immediate detection and blocking by SOC and incident response teams.

Low-level data about malware, infrastructure, and artifacts, often machine-consumed at scale; it overlaps tactical intelligence but emphasizes raw technical detail over narrative.

Intelligence derived from publicly available information such as vendor blogs, government advisories, social media, and code repositories, collected legally and at low cost.

Intelligence obtained through paid feeds, commercial vendors, or trusted private sharing communities, typically offering curated data and sometimes exclusivity or faster delivery.

A grouping of related malicious activity attributed to a common actor or objective over time, used to connect separate incidents into a coherent picture.

A person or group conducting malicious activity, described by motivation, capability, resources, and targeting, from opportunistic criminals to state-sponsored groups.

The judgment that a particular actor is responsible for activity, always probabilistic and requiring multiple independent evidence lines; overconfidence here carries diplomatic and legal risk.

Proactive, hypothesis-driven search through environments for undetected adversary activity, using intelligence to guide where to look rather than waiting for alerts.

The disciplined creation, testing, and tuning of detection logic mapped to adversary behaviors, with measured coverage, false positive rates, and change control.

Delivering finished intelligence to the right consumers in the right format and timeframe, with handling restrictions, so it can actually influence a decision.

A group of organizations that exchange threat information under agreed trust, handling, and legal terms, such as an ISAC or a national CERT partnership.