Mile2 C)TIA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Intelligence cycle phases

Ordered sequence: requirements and planning, collection, processing, analysis and production, dissemination, then feedback. Feedback loops back to requirements, restarting the cycle and refining what collectors are tasked to gather.

Data versus intelligence

Data is raw unprocessed observation, information is data placed in context, and intelligence is information analyzed against a requirement to support a specific decision. Only the last drives action.

Analysis of Competing Hypotheses

A structured analytic technique that lists plausible hypotheses, maps evidence as consistent or inconsistent with each, and favors the hypothesis with the least inconsistent evidence rather than the most confirming evidence.

Diamond Model vertices

Four vertices: adversary, capability, infrastructure, and victim. Edges describe social-political and technical relationships, and meta-features capture timestamps, phase of intrusion, result, and confidence.

Cyber Kill Chain stages

Seven sequential stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders map observed activity to a stage to choose disruption points.

TTPs versus atomic IOCs

Tactics, techniques, and procedures describe adversary behavior and persist across campaigns, while atomic indicators such as hashes and IP addresses change quickly. Detection engineering therefore prioritizes TTP-based analytics.

Attribution confidence

Attribution is a probabilistic judgment weighing tradecraft, infrastructure reuse, code overlap, language artifacts, and timing. False flags deliberately imitate another actor, so single-indicator attribution is unreliable.

Cognitive bias in analysis

Analysts default to confirmation bias, anchoring on the first hypothesis, and mirror-imaging adversaries. Structured techniques, peer review, and explicit assumption checks are used to surface and counter these errors.

Strategic versus tactical intelligence

Strategic intelligence addresses long-term risk and policy for executives; tactical intelligence supplies immediate, technical indicators and detection content for security operations staff. They differ in audience, time horizon, and classification.

Admiralty reliability scale

Source reliability runs A (completely reliable) through F (cannot be judged). Information credibility runs 1 (confirmed by other sources) through 6 (cannot be judged). Ratings combine, for example B2.

STIX domain objects

STIX 2.x structures threat data as domain objects such as indicator, malware, threat-actor, campaign, and report; relationship objects link them, and cyber-observable objects represent IPs, files, and domains.

TAXII protocol purpose

TAXII is an application-layer protocol for exchanging cyber threat information over HTTPS. Version 2.x organizes data into collections and channels; version 1.x used services and subscriptions instead.

Indicator decay

The rate at which an indicator loses detection value over time. IP addresses and domains decay fastest, file hashes moderately, and TTPs slowest; each type needs a time-to-live before sharing.

Priority intelligence requirements

PIRs are the questions leadership most needs answered to make decisions. They drive collection planning and tasking, and every intelligence product should trace back to at least one requirement.

OSINT collection

Open-source intelligence is gathered from publicly available sources such as vendor blogs, government advisories, social media, paste sites, and certificate transparency logs, then validated before operational use.

Indicator hygiene before ingestion

Validate format, deduplicate across feeds, remove known-good values such as CDN and public resolver addresses, and record first-seen and last-seen dates. Skipping these steps produces false positives.

Feed confidence scoring

A score combining source reliability, indicator age, corroboration by independent feeds, and historical true-positive rate. The score determines whether an indicator is blocked, alerted on, or only logged.

Open-source feed examples

AlienVault OTX, abuse.ch services including URLhaus and MalwareBazaar, CISA's Automated Indicator Sharing, and MISP community instances. Commercial feeds add curation but still require local validation.

MISP event structure

A MISP event bundles attributes such as IPs, domains, and hashes, plus objects, galaxies, and tags. Sharing groups and distribution levels determine which communities receive the event.

OpenCTI architecture

OpenCTI stores STIX 2.1 entities and relationships in a graph backend with Elasticsearch for search, and uses connectors to ingest feeds and enrich observables with external context.

TheHive and Cortex roles

TheHive manages security cases and observables collaboratively; Cortex is the companion engine that runs analyzers for enrichment and responders for automated action on those observables.

TIP core functions

A threat intelligence platform aggregates, normalizes, deduplicates, scores, and ages indicators, then distributes them through APIs to enforcement points including SIEM, firewall, proxy, EDR, and DNS.

YARA rule purpose

YARA rules match static file or memory content using text or byte strings plus a boolean condition. Analysts use them to classify and detect malware families across samples.

Sigma rule purpose

Sigma expresses log-based detection logic in a vendor-neutral YAML format that converts into queries for many SIEM platforms, making detections portable across different backends.

Enrichment data sources

WHOIS and RDAP registration data, passive DNS history, VirusTotal multi-engine results, Shodan exposure data, GreyNoise noise classification, and sandbox behavioral reports add context to raw observables.

Indicator aging and revocation

A TIP function that expires or retracts indicators past their useful life and pushes removal to enforcement points. Without it, stale blocklists cause false positives and service outages.

TLP 2.0 marking levels

RED limits sharing to named recipients only; AMBER allows sharing within the organization and its clients; GREEN permits community sharing; CLEAR allows public distribution. Markings govern dissemination.

BLUF reporting structure

Bottom line up front: the key judgment and recommended action appear first, followed by supporting evidence, analytic confidence, and source notes. This matches how decision makers read.

Words of estimative probability

Standardized probability terms: almost certain near 95 percent, likely near 70 to 80 percent, roughly even chance near 50 percent, unlikely near 20 to 30 percent, and remote near 5 percent.

Tactical intelligence product

A product aimed at security operations: current indicators, detection signatures, and mitigation steps tied to active threats, delivered on a short cycle so defenders can act immediately.

Intelligence program feedback metrics

Measures such as the share of shared indicators that produced true positives, time from indicator receipt to deployed detection, and products consumed per requirement show whether the program delivers value.

Analyst operational security

Analysts query suspicious indicators through proxies and segregated infrastructure, because direct lookups reveal the defender's interest to adversaries who monitor their own infrastructure.