Threat Intelligence Analysis and Production
This domain tests whether you can turn collected material into a defensible judgement: structured, sourced, confidence-rated, and written for a named audience.
Product structure
Lead with the bottom line (BLUF), then key judgements, then evidence and analytic rationale, then confidence and gaps. Every judgement should trace to evidence and to a named technique, not to intuition.
Frameworks and when to use them
- Cyber Kill Chain: linear; good for executive narrative and locating where a detection sits.
- Diamond Model: event-centric - adversary, capability, infrastructure, victim; best for clustering activity and pivoting.
- MITRE ATT&CK: behaviour taxonomy; maps what the adversary did to detections and coverage gaps. Use it for TTP-level analysis, not as a matrix to fill in.
Confidence language
Use a defined scale and tie it to evidence quality. High: corroborated by multiple independent sources or direct observation. Moderate: credible single source or partial corroboration. Low: fragmentary, single unverified source. Never write high confidence to mean "fairly sure".
Structured techniques
Analysis of Competing Hypotheses (ACH) tests all evidence against every hypothesis and looks for discriminating evidence rather than confirming evidence. Complement it with a key-assumptions check, red-team review, devil's advocacy, and a quality-of-information check.
Worked example
Two hypotheses: H1, a ransomware affiliate with commodity tooling; H2, a state actor with custom tooling. Evidence: Cobalt Strike beacon (consistent with both); Mimikatz (both); a custom loader seen once (mildly favours H2); a ransom note staged on a share (strongly favours H1); infrastructure overlapping three prior ransomware incidents (favours H1). ACH scoring: H1 has no strong inconsistency; H2 is contradicted by the staged note and shared infrastructure. Conclusion: H1 at moderate confidence, with the loader keeping H2 alive. The report names the trigger that would revise the call - a second victim with the same loader and no ransom note.
Traps
Building the narrative around the first hypothesis (confirmation bias). Over-precise attribution such as "APT-X, 95% certain" on circumstantial evidence. Confusing an indicator match with a capability assessment. Omitting gaps and revision triggers. Filling an ATT&CK matrix with every known technique instead of the evidenced ones.