I85PREP
⌘ K
CTSP study materials
CTSP study resources

CTSP: Threat Intelligence Platforms and Tooling

CTSP · Work through your exam, one topic at a time.

All guide sections

Threat Intelligence Platforms and Tooling

What this domain tests

Threat intelligence platforms and tooling tests whether you understand how a TIP ingests, normalizes, enriches, stores, scores, and shares intelligence, and how standards such as STIX/TAXII and MISP fit together. Expect questions about data models, integrations, and platform workflows rather than product buttons.

Platform capabilities

A TIP is a workflow system, not a feed dump. Core capabilities include ingestion from feeds, APIs, and email; normalization to a common data model; deduplication; enrichment (WHOIS, passive DNS, malware analysis, geolocation); scoring and aging; relationship mapping; dissemination and sharing; access control; and integration with SIEM, SOAR, EDR, firewalls, and ticketing.

Standards and formats

  • STIX 2.1 is a graph-based language for cyber threat intelligence. Objects include Indicator, Observed Data, Malware, Threat Actor, Campaign, Infrastructure, Course of Action, and Relationship. Indicators use patterns and can carry confidence, valid_from/valid_until, labels, and TLP markings.
  • TAXII 2.1 defines a RESTful API for exchanging STIX over HTTPS, organized into collections.
  • MISP is an open-source sharing platform with events, attributes, galaxies, and taxonomies; it exports STIX and supports feeds.
  • Detection formats: YARA for files and memory, Sigma for log detections, Snort/Suricata for network signatures, and STIX patterning for TIP logic.

Operations and governance

Evaluate feeds before onboarding: relevance, overlap, false-positive rate, update cadence, licensing, and sharing restrictions. Use a lifecycle: request, evaluate, pilot, deploy, tune, and retire. Measure precision and analyst time saved, not feed volume. Respect TLP and source handling caveats; sharing a feed may violate its terms.

Worked example

A C2 domain is observed in a campaign. The STIX model uses an Indicator object with a domain-name pattern, valid_from, confidence, and a TLP marking; an Observed Data object records the sighting; a Relationship object links the Indicator to a Malware object, and another links the Malware to a Threat Actor. The TAXII collection exposes the bundle to partners at the permitted TLP. The reasoning is that object relationships preserve meaning that a flat IOC list loses, and the validity window prevents stale blocking.

Traps that cost marks

  • Treating a TIP as a feed aggregator with no workflow or aging.
  • Ignoring STIX relationship semantics and confidence.
  • Sharing data without checking TLP and license terms.
  • Deploying feeds without measuring precision or overlap.
  • Forgetting that STIX, MISP, and TAXII solve different problems.
  • Assuming a platform's score is an analytic judgment.