Threat Intelligence and Incident Management
What the domain really tests
This domain combines turning threat information into decisions and responding when prevention fails. For intelligence, know the levels - strategic (executive, long-range), operational (campaigns, actor intent), tactical (TTPs and adversary behavior), and technical (indicators such as hashes, domains, IPs) - and that indicators are perishable while TTPs endure. Understand the intelligence cycle (direction, collection, processing, analysis, dissemination, feedback), source types (OSINT, commercial, community, internal telemetry), and frameworks such as the cyber kill chain and MITRE ATT&CK used to structure adversary behavior.
For incident management, know the response life cycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Know CSIRT roles, escalation paths, severity classification, communications (internal, legal, regulatory, customer), and evidence handling - chain of custody, hashing, and order of volatility (registers and cache, memory, network state, then disk, then backups and archival media). Coordination with legal counsel around privilege and disclosure obligations matters.
Traps
- Containing an incident before preserving volatile evidence when the stem says attribution or prosecution is a factor.
- Confusing threat data (raw indicators) with intelligence (analyzed, contextualized, decision-relevant).
- Skipping lessons learned because recovery succeeded.
- Assuming eradication and recovery are the same phase.
- Over-collecting indicators with no context, creating alert fatigue.
Rule of thumb
Collect most volatile evidence first. If the choice is between two forensic targets, the one that disappears fastest wins.
Worked example: A host shows beaconing. The team wants to image the disk immediately. The better sequence is to capture memory and volatile network state first, because malware and live connections vanish on shutdown, then isolate the host to stop the beaconing, then image the disk. Containment is coordinated so that it does not destroy evidence needed for scope analysis.