I85PREP
⌘ K
CTDC study materials
CTDC study resources

CTDC: Threat Intelligence and Indicator Management

CTDC · Work through your exam, one topic at a time.

All guide sections

Threat Intelligence and Indicator Management

Threat Intelligence and Indicator Management tests whether you can take a feed, decide what it is worth, deploy it without breaking the business, and retire it before it rots. Items focus on lifecycle discipline and the difference between context and blocking.

Core rules

  • Intel levels. Strategic (who and why, for leadership), operational (campaigns and actor intent), tactical (TTPs for detection engineering), technical (indicators for matching). Exam items often ask which level a given artifact serves.
  • Standards and formats. STIX 2.1 for representation, TAXII 2.1 for transport, MISP and OpenCTI for sharing and correlation, YARA for file and memory signatures, OpenIOC legacy but still encountered. TLP 2.0 markings (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) govern redistribution - violating them is both a policy and an exam error.
  • Pyramid of Pain. Hash and IP indicators are cheap for an adversary to change; domain, network artifact, host artifact and finally TTP indicators cost progressively more to evade. Prioritize detections built on the upper layers.
  • Lifecycle: collection, normalization, deduplication, scoring with confidence, deployment, hit monitoring, decay and retirement. Every indicator needs first-seen, last-seen and a TTL.
  • Context gates action. A hash with a malware family and campaign is actionable for blocking; a bare IP is actionable only for alerting, because shared hosting, CDNs and cloud egress ranges generate false positives by construction.

Worked example

Two indicators arrive: a SHA-256 of a loader and a /32 that resolves to a major cloud provider. Reasoning: the hash is high fidelity - file content is specific, collision risk is negligible and blocking costs nothing operationally, so deploy to endpoint and file scanning with a long TTL. The IP is low fidelity: thousands of legitimate tenants share it, so blocking would cause outages. Deploy it as an alert-only match with a 30-day TTL, correlate with the domain and JA3 from the same report, and require a second signal before containment.

Traps that cost marks

Blocking cloud or CDN ranges at the perimeter. Deploying indicators with no expiry so the blocklist grows into an outage generator. Treating a commercial feed as ground truth without scoring. Forwarding TLP:RED content into a widely readable ticket queue.