Threat Intelligence Fundamentals and Frameworks
What this domain tests
Threat intelligence fundamentals and frameworks test whether you can distinguish data, information, and intelligence, select the right framework for a question, and describe the intelligence cycle as a requirements-driven process rather than a feed-consumption habit. Expect definitions, framework components, and questions that ask you to map an intrusion to a model.
Core rules and concepts
- DIKW chain. Data are unprocessed observations (logs, packet captures, a file hash). Information adds context (this hash was seen in a phishing wave). Intelligence is analyzed, evaluated, and tied to a decision or requirement. Many feeds sell information, not intelligence.
- Levels of intelligence. Strategic intelligence supports long-range planning and business risk; operational intelligence explains campaigns, actor intent, and timing; tactical intelligence supports detection and response through TTPs and indicators. The levels differ by consumer, time horizon, and detail, not by source.
- Intelligence cycle. Planning and direction (driven by priority intelligence requirements, PIRs), collection, processing and exploitation, analysis and production, dissemination, and feedback. Feedback should modify the PIRs and collection plan.
- Frameworks. The Diamond Model describes every intrusion event through adversary, capability, infrastructure, and victim, with meta-features such as timestamp, phase, result, direction, and methodology. The Cyber Kill Chain describes phases from reconnaissance through actions on objectives and is useful for discussing interruption points. MITRE ATT&CK is a knowledge base of adversary tactics and techniques observed in the wild and is used for detection mapping and coverage discussion. F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate) links intelligence to operations.
- Confidence and sourcing. Finished intelligence states source reliability, information credibility, and analytic confidence. The Admiralty code (A–F reliability, 1–6 credibility) is a common convention. Confidence is not the same as probability.
Worked example
A vendor reports a phishing email with a macro that downloads a Cobalt Strike beacon. A weak answer repeats the hash and domain. A stronger answer maps the event: Diamond Model - victim is a finance team, capability is the macro loader and beacon, infrastructure is a lookalike domain and VPS, adversary is an unattributed cluster; Kill Chain - delivery, exploitation, installation, command and control; ATT&CK - T1566.001, T1204.002, T1071.001. The reasoning is that the model organizes the same facts for different consumers, and the ATT&CK mapping supports detection coverage questions. The finished product should add an assessment, confidence, and recommended actions.
Traps that cost marks
- Calling an indicator feed "threat intelligence" without analysis or a requirement.
- Treating the Kill Chain as strictly linear; adversaries skip and repeat phases.
- Using ATT&CK technique counts as a security score rather than a coverage and communication tool.
- Confusing analytic confidence with the probability that an event will occur.
- Ignoring PIRs and collecting because a source is available.