Threat Intelligence Analysis
The Analysis domain tests whether you can turn collected data into a defensible judgment: picking the right intelligence level, applying a model correctly, running structured reasoning, and stating confidence honestly.
Start with the consumer, then the level
Technical intelligence (hashes, IPs, domains, JA3 fingerprints) feeds detection engineering and expires quickly. Tactical intelligence describes adversary TTPs and survives infrastructure changes. Operational intelligence covers specific campaigns, timing and resourcing. Strategic intelligence addresses intent, capability and risk for executives and planners. A board asking about ransomware exposure does not want a list of /24 netblocks, and a SOC analyst does not need a geopolitical essay.
Know the three models cold
- Cyber Kill Chain: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Use it to place detections along an intrusion and expose gaps.
- Diamond Model: adversary, capability, infrastructure, victim, plus socio-political and technical meta-features. Shared infrastructure or capability is what links events into a campaign.
- MITRE ATT&CK: tactics are the adversary's goal (why), techniques are how, procedures are the specific implementation. ATT&CK is not a kill chain and tactics are not strictly sequential.
Structured reasoning
Use Analysis of Competing Hypotheses, Key Assumptions Check, devil's advocacy and what-if analysis to counter confirmation bias and anchoring. Record the hypothesis you rejected and why; that is what makes an assessment auditable.
Worked example
Two phishing domains resolve to the same /24 and present the same TLS certificate. Hypothesis A: one actor. Hypothesis B: shared hosting. ACH scoring shows certificate reuse and an identical lure template weaken B but do not eliminate it, because cheap hosting clusters. Pivot on Diamond infrastructure, map the lure to ATT&CK T1566.001, and report "likely same actor, moderate confidence," explicitly noting the hosting alternative.
Traps that cost marks
Calling a tactic a technique, treating an IOC as durable intelligence, inflating confidence to sound decisive, or presenting one hypothesis as if ACH had been run. Strategic versus operational products are confused more than any other pair.