Mile2 C)TIA key terms

Evidence-based knowledge about existing or emerging hazards, including context, mechanisms, indicators, implications, and advice, that supports decisions about how to respond to a threat.

The repeating process of planning and direction, collection, processing, analysis and production, and dissemination, followed by feedback that restarts the loop.

Documented questions or priority information needs that guide what analysts collect and report, derived from stakeholder decisions and risk priorities.

A ranked subset of intelligence requirements that leadership treats as most urgent, directing collection and analysis effort toward decisions with the highest impact.

Long-horizon analysis of threat actors, intent, and geopolitical or sector trends, written for executives to shape risk posture, investment, and policy rather than immediate detection.

Analysis of specific campaigns, actor capabilities, and planned activity that informs how defenders organize resources and counter a particular adversary operation.

Short-lived, technical detail such as indicators, tooling behavior, and adversary techniques used by defenders to detect, block, or hunt activity in the near term.

An observable artifact such as a file hash, domain, IP address, or registry key that suggests a system may have been breached, useful mainly for matching known bad activity.

Evidence of adversary behavior or intent during an intrusion, such as unusual process ancestry or command patterns, which detects activity even when specific artifacts change.

A layered description of adversary behavior: the goal (tactic), the general method used (technique), and the specific implementation details observed (procedure).

A publicly maintained knowledge base of adversary tactics and techniques organized by platform, widely used to structure detection coverage, hunting plans, and threat reporting.

An analytic framework relating four core features of any intrusion: adversary, capability, infrastructure, and victim, used to pivot between related events and campaigns.

A phased model of an intrusion from reconnaissance through actions on objective, used to describe where activity sits and where controls can interrupt it.

A person, group, or organization conducting malicious activity, described by motivation, sophistication, resources, and targeting rather than by a single tool.

A well-resourced actor that sustains covert access to chosen targets over long periods, prioritizing mission objectives over quick financial gain.

An actor driven by ideological or political goals who uses disruption, defacement, or data leaks to attract attention rather than to profit directly.

A financially motivated actor, often operating as a business with specialized roles, that monetizes access through fraud, extortion, or sale of stolen data.

A criminal arrangement in which developers lease ransomware and support to affiliates who carry out intrusions and share a percentage of the extortion payment.

An intermediary that sells footholds such as valid credentials or remote-access sessions to other actors, separating intrusion from monetization.

A set of related malicious activities attributed to the same actor or infrastructure over time, tracked as a unit for analysis and reporting.

A measurable state or event in a network or host, such as a log entry or file creation, that may or may not be malicious depending on context.

A stated judgment about how much trust to place in an assessment, based on source reliability, corroboration, and analytic method, ideally expressed with a defined scale.

An evaluation of how trustworthy a provider or sensor is, independent of whether the specific data it supplied is accurate.

A two-part grading scheme rating source reliability and information credibility separately, commonly expressed as letters paired with numbers.

Intelligence derived from publicly available information such as websites, registries, social media, and publications, gathered legally and refined through analysis.

The disciplined practice of gathering public data using search techniques, monitoring, and tooling while recording provenance and respecting legal limits.

Data obtained from restricted channels such as commercial feeds, vendor telemetry, information-sharing communities, or law enforcement rather than public sources.

A sector-focused community where members exchange threat data and alerts under agreed handling rules to improve collective defense.

A marking scheme using four colors to tell recipients how far shared information may be redistributed, from internal-only to fully public.

A standardized, machine-readable language for representing cyber threat intelligence objects and their relationships so tools can exchange them consistently.

A transport specification for exchanging STIX-formatted threat intelligence over HTTPS using collections, channels, and publish-subscribe patterns.

Software that ingests, normalizes, deduplicates, scores, and stores threat data from many feeds, and distributes indicators to security controls.

The process of pulling data from internal and external sources into a platform, handling formats, schedules, authentication, and error recovery.

Converting heterogeneous source data into a common schema and vocabulary so records can be compared, correlated, and searched reliably.

Adding context such as geolocation, registration age, malware family, or actor attribution to an indicator so analysts can judge its relevance and risk.

An alert or indicator match that appears malicious but is benign, often caused by shared hosting, stale data, or overly broad matching logic.

Checking that collected intelligence is accurate, current, correctly formatted, and relevant before it is trusted or used in detection.

Proactive, hypothesis-driven searching through environment data for hidden adversary activity that existing detections did not catch.

Delivering finished intelligence to the right consumers in a usable form and timeframe, with handling caveats and feedback channels included.

A written product that states key judgments, supporting evidence, confidence, and recommended actions for a defined audience and decision.