TPFP TI key terms

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and implications, that supports decisions about how to respond to that threat.

The repeating process of planning requirements, collecting data, processing it, analyzing it into intelligence, and disseminating the result to decision-makers, then feeding feedback into the next round.

Intelligence focused on immediate adversary behaviors and technical artifacts, such as hashes, IP addresses, and malware signatures, used to detect and block attacks in the short term.

Intelligence describing specific campaigns, actor tools, infrastructure, and intent, helping defenders understand how and why an adversary operates against their sector or organization.

High-level intelligence about long-term threat trends, adversary capability, and risk to the organization, written for executives and used to guide investment and policy decisions.

Documented questions or priorities that define what decision-makers need to know, guiding collection and analysis so that limited resources target the most relevant threats.

The subset of intelligence requirements judged most critical to leadership decisions, ranked so collection and analysis effort is directed at the questions that matter most now.

Observable technical artifacts such as file hashes, domain names, IP addresses, or registry keys that suggest a system may have been breached or malicious activity occurred.

Observable signs of active adversary behavior or intent during an intrusion, such as unusual process chains or lateral movement patterns, which are harder for attackers to change than static artifacts.

A model ranking indicator types by how much difficulty an adversary faces when forced to change them, from easy-to-change hashes at the base to hard-to-change tactics and techniques at the top.

Information gathered from publicly available sources such as websites, social media, government records, and news, collected and analyzed while respecting legal and privacy constraints.

Threat data obtained from restricted or paid sources, such as commercial feeds, vendor reports, information-sharing communities, or internal telemetry not available to the general public.

Information collected through human interaction, such as interviews, trusted peer contacts, or underground community sources, often providing context that automated collection cannot supply.

A deliberately exposed decoy system or service designed to attract attackers so their activity, tools, and infrastructure can be observed and recorded for intelligence purposes.

An isolated environment where suspicious files are executed and monitored, capturing behavior such as file changes, network connections, and persistence mechanisms for analysis.

Examining a file or binary without running it, using techniques such as string extraction, header inspection, and disassembly to identify capabilities and potential malicious traits.

Observing a sample while it executes in a controlled environment, recording its runtime behavior, network traffic, and system modifications to understand what it actually does.

An analytic framework describing every intrusion event through four linked vertices: adversary, capability, infrastructure, and victim, used to find relationships and pivot between related events.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform and used to structure detection, hunting, and threat assessment.

A seven-stage model of an intrusion, from reconnaissance and weaponization through exploitation, installation, command and control, and actions on objectives, used to plan defenses at each stage.

The behavioral description of an adversary: high-level goals (tactics), general methods used to achieve them (techniques), and the specific detailed implementations observed (procedures).

An individual or group conducting malicious activity, described by attributes such as motivation, capability, resources, and targeting, which help predict future behavior.

A well-resourced actor that conducts prolonged, stealthy intrusions with custom tooling and sustained command and control, typically pursuing espionage or strategic objectives rather than quick profit.

A set of related malicious activities conducted by the same actor over a period, sharing infrastructure, tooling, or targeting, and tracked as a single analytic object.

The analytic judgment assigning an activity to a specific actor or group, expressed with an explicit confidence level because evidence is often incomplete or deliberately deceptive.

A stated estimate of how strongly the available evidence supports an analytic judgment, allowing consumers to weigh intelligence appropriately rather than treating all conclusions as equally certain.

Formal methods such as key assumptions checks, alternative competing hypotheses, and devil's advocacy that reduce cognitive bias and improve rigor in intelligence judgments.

A structured technique that lists plausible explanations for observed activity and evaluates evidence against each, seeking to disprove hypotheses rather than confirm a favored one.

A systematic pattern of deviation from rational judgment, such as confirmation or anchoring bias, that can distort threat analysis and must be actively mitigated.

A sharing convention using color markings (red, amber, green, clear) to tell recipients how far shared information may be redistributed, protecting sensitive sources and relationships.

A sector-based or regional community where members exchange threat information and best practices under agreed handling rules, often supported by a trusted automated exchange platform.

Threat data formatted in a structured, standardized way, such as STIX, so tools can automatically ingest, correlate, and act on it without manual interpretation.

A structured, standardized language for representing cyber threat information as objects and relationships, enabling consistent exchange of indicators, actors, and campaigns between tools.

A standardized protocol for transporting and exchanging cyber threat information between servers and clients, commonly used to distribute STIX data in an automated, authenticated way.

A system that aggregates, normalizes, correlates, and scores threat data from multiple sources, then distributes actionable intelligence to security controls and analysts.

Adding context to a raw indicator, such as geolocation, WHOIS data, malware family, or first-seen date, so analysts can judge its relevance and reliability before acting.

An alert or indicator that appears malicious but is actually benign, which can waste response effort and erode trust if not measured and tuned.

Adjusting detection rules, feed selections, and scoring thresholds to reduce noise and false positives while preserving coverage of the threats that matter to the organization.

A proactive, hypothesis-driven search through networks and endpoints for signs of compromise or adversary activity that existing automated detection has not caught.

Identifying malicious activity by the patterns of behavior it produces rather than by fixed artifacts, making detection more resilient to attackers changing hashes or infrastructure.

A platform that collects, correlates, and alerts on log and event data from across the environment, serving as a primary consumer of tactical threat intelligence feeds.

Practices that protect an organization's own sensitive data, sources, and investigation methods from disclosure, including compartmentalization, secure communications, and careful attribution handling.

Documented rules governing how threat information is classified, stored, accessed, shared, and destroyed, ensuring legal compliance and protection of sensitive sources.

Legal and ethical obligations to limit collection, use, and retention of information about identifiable individuals encountered during threat research, such as victim or employee details.

Gathering threat data within legal and ethical boundaries, avoiding unauthorized access to systems, entrapment, or harm to third parties while pursuing investigative objectives.

Observing criminal marketplaces and forums, often with controlled personas and legal oversight, to learn about leaked data, tooling, and planned attacks against the organization.

The infrastructure and channels an attacker uses to communicate with compromised systems, issue instructions, and exfiltrate data, often disguised as normal traffic.

A network of interconnected honeypots and supporting sensors deployed to observe attacker behavior across multiple services and gather richer intelligence than a single decoy.

A documented schedule of which sources will be used, what data will be gathered, and how often, aligned to intelligence requirements so collection effort stays focused and auditable.

Delivering finished intelligence to the right consumers in a usable format and timely manner, with handling restrictions and feedback channels to confirm it meets their needs.

A written product presenting findings, evidence, and judgments for a defined audience, typically including key judgments, technical detail, confidence statements, and recommended actions.

Intelligence specific enough, timely enough, and contextualized enough that a defender can take a concrete action, such as blocking, hunting, or patching, based on it.

The overall picture of threats relevant to an organization or sector at a given time, including prevalent actors, attack methods, and targeted industries.

Automated extraction of data from websites for collection purposes, which must respect site terms, rate limits, and legal constraints on the data gathered.