TPFP TI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Intelligence Cycle

Six-phase loop of direction, collection, processing, analysis, dissemination, and feedback that turns raw data into decision-ready intelligence and restarts with new requirements.

Pyramid of Pain

Model ranking indicators by the cost they impose on an adversary, from easily changed hashes and IPs up to costly tactics, techniques, and procedures.

Diamond Model

Framework linking four core nodes, adversary, capability, infrastructure, and victim, joined by social-political, technical, and operational relationships for intrusion analysis.

Strategic Intelligence

Long-horizon assessment of threat actors, intent, and risk written for executives and policymakers, emphasizing trends and business impact over atomic indicators.

STIX 2.1

Structured Threat Information Expression, a JSON-based standard for representing indicators, malware, threat actors, and relationships so tools can exchange intelligence consistently.

TAXII 2.1

Transport protocol that delivers STIX content over HTTPS, defining collections, channels, and API roots so sharing communities can automate indicator exchange.

Passive DNS

Historical record of domain-to-IP resolutions gathered from recursive resolvers, used to map infrastructure and uncover past hosting links during pivoting.

Sinkhole

Controlled redirection of malicious traffic to a monitored server, revealing which internal hosts still beacon to a command-and-control domain.

Admiralty Grading

Two-axis scheme rating source reliability A to F and information credibility 1 to 6, producing a combined code such as A1 for confirmed reliable reporting.

Analysis of Competing Hypotheses

Structured technique that lists plausible explanations, evaluates evidence for consistency with each, and favors the hypothesis with the fewest contradictions.

Cyber Kill Chain

Seven-phase model of an intrusion: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

ATT&CK Technique

Specific adversary method mapped under a tactic, identified by an ID such as T1566, enabling consistent detection coverage and reporting across teams.

Indicator Pivoting

Expanding an investigation from one observable to related infrastructure or samples using passive DNS, certificate transparency, WHOIS history, and malware similarity.

TLP 2.0

Traffic Light Protocol markings RED, AMBER, AMBER+STRICT, GREEN, and CLEAR that define permitted sharing scope and must travel with the shared content.

ISAC

Information Sharing and Analysis Center, a sector-focused community where members exchange threat data under membership terms and trust relationships.

De-identification Before Sharing

Removing victim names, internal addresses, and personal data from intelligence products so shared indicators cannot expose the reporting organization or individuals.

Sharing Agreement

Contract such as an NDA or MOU that defines what intelligence may be shared, with whom, and under what handling restrictions beyond TLP conventions.

OPSEC Process

Five steps: identify critical information, analyze threats, analyze vulnerabilities, assess risk, and apply countermeasures to protect sensitive activity.

Rules of Engagement

Documented scope authorizing specific defensive or active measures, including escalation paths and legal approval, before any action is taken.

Data Minimization

Privacy principle requiring collection and retention of only personal data necessary for the stated purpose, limiting exposure in intelligence repositories.

Computer Fraud and Abuse Act

United States statute criminalizing unauthorized access to protected computers, making written authorization essential for any security testing or active defense.

Threat Intelligence Platform

System that ingests, normalizes, deduplicates, scores, and distributes indicators and reports to SIEM, SOAR, and detection tools.

MISP

Open-source threat sharing platform organizing intelligence as events and attributes with taxonomies and galaxies, supporting STIX export and TAXII.

OpenCTI

Graph-based knowledge platform built on STIX 2.1 that connects feeds, sandboxes, and SIEMs to model actors, infrastructure, and relationships.

YARA Rule

Pattern-matching rule describing strings and conditions that identify a malware family in files or memory, widely used for detection and hunting.

Sigma Rule

Vendor-neutral detection rule format for log events that converts into queries for many SIEM platforms, simplifying portable detection engineering.

SOAR

Security orchestration, automation, and response platform executing playbooks that enrich alerts, query intelligence, and trigger containment actions.

NIST IR Lifecycle

Four phases from SP 800-61: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Hypothesis-Driven Hunting

Hunting method that starts from a testable statement derived from intelligence, then queries telemetry to confirm or refute it and produce detections.

IOC Sweep

Rapid search of environment telemetry for known indicators; fast to run but fragile because adversaries rotate infrastructure and hashes frequently.

Purple Teaming

Collaboration where attack emulation validates whether defensive detections fire, converting hunt findings into tested, documented detection rules.

Scoping an Intrusion

Determining the full extent of compromise using intelligence about adversary TTPs, guiding containment priorities and predicting further attacker activity.