PECB Certified Cyber Threat Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Threat hunting definition

A proactive, hypothesis-driven, iterative process of searching networks and endpoints for adversary activity that existing detection controls have not identified, performed by skilled analysts rather than automated alerting alone.

Cyber threat intelligence

Evidence-based knowledge about an existing or emerging threat, including context, mechanisms, indicators, implications, and actionable advice sufficient to inform decisions about the threat response.

Intelligence cycle stages

Direction and planning, collection, processing, analysis and production, dissemination, and feedback. The cycle repeats whenever requirements or the threat landscape change, keeping intelligence aligned with decisions.

Pyramid of Pain

A model ranking indicators by the difficulty they cause an adversary to change: hash values, IP addresses, domain names, network and host artifacts, tools, and finally tactics, techniques, and procedures.

Diamond Model

An intrusion analysis model with four vertices: adversary, capability, infrastructure, and victim. Relationships between vertices are pivot points that link related events into coherent campaigns.

MITRE ATT&CK tactics

Tactics are the adversary's tactical goals, such as persistence or credential access. Techniques describe how each goal is achieved. Mapping detections to techniques exposes coverage gaps.

F3EAD loop

Find, Fix, Finish, Exploit, Analyze, Disseminate. It couples intelligence with operations; the Analyze and Disseminate stages generate new requirements that restart the Find stage.

Hunt hypothesis requirement

A hunt must begin with a testable statement about expected adversary behavior and observable evidence. Without it, activity is exploratory analytics and results cannot be validated or reproduced.

Hunt lifecycle phases

Trigger and scope definition, hypothesis formulation, data collection and validation, analysis, finding classification, response, and documentation. Each phase produces artifacts feeding the next hunt.

Data readiness check

Pre-hunt verification of log source coverage, retention window, timestamp accuracy, field normalization, and asset inventory completeness. Unverified data invalidates negative findings from a hunt.

NIST incident phases

Preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. The phases overlap in practice and post-incident lessons feed back into preparation.

Containment strategy criteria

Selection depends on potential damage and theft, evidence preservation needs, service availability, time and resources required, and the effectiveness of each strategy against the observed adversary.

Incident severity inputs

Data sensitivity, number of affected assets, business criticality, adversary capability, and containment difficulty. These inputs determine escalation path, notification obligations, and resource allocation.

Playbook versus runbook

A playbook is a decision flow for a scenario type, showing branches and escalation points. A runbook lists concrete commands, owners, and expected outputs for execution.

Tabletop exercise purpose

A discussion-based rehearsal of the incident plan without production impact. It measures detection time, escalation accuracy, decision latency, and communication completeness against defined success criteria.

Chain of custody

A documented record of who collected, handled, and stored evidence, when, and how. Integrity is supported by hashing acquired images and storing copies on access-controlled media.

Analysis of competing hypotheses

A structured technique that enumerates alternative explanations, rates evidence consistency, seeks refutation rather than confirmation, and reports the hypothesis surviving least refutation.

Indicator pivoting

Using a shared attribute such as a command-and-control domain, certificate, or user agent to cluster related activity. Pivoting on techniques yields more durable detections than pivoting on hashes.

Timeline normalization

Converting all event timestamps to a common time zone, usually UTC, and quantifying clock skew between sources before ordering events in an intrusion reconstruction.

Hunt knowledge base

A maintained repository of hypotheses, results, detection rules with rationale, false-positive notes, actor profiles, and ATT&CK coverage mapping that preserves analytic work across analyst turnover.

Detection rule quality metrics

True positive rate, false positive rate, mean time to detect, rule age, and technique coverage. Rules without a documented owner and review date are maintenance liabilities.

TTP versus IOC detection

Technique-based detection survives campaign changes because adversary behavior persists while infrastructure, domains, and hashes rotate frequently. IOC detection is precise but short-lived.

Cyber Kill Chain stages

Reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Mapping findings to stages identifies where defenses failed.

Analytic confidence statement

Reports must separate observed facts from analytic judgments and state a confidence level with supporting evidence, keeping conclusions defensible when reviewed later.

Control type categories

Preventive controls block, detective controls identify, corrective controls restore, and compensating controls substitute when a primary control is infeasible. Each is also administrative, technical, or physical.

Defense in depth

Layering controls across perimeter, network, endpoint, identity, data, and application tiers so a single control failure does not directly expose a critical asset.

Least privilege principle

Granting only the access required for a task, with privileged access time-bound, logged, and reviewed on a defined cadence to limit the blast radius of compromise.

Change management steps

Request, risk assessment, approval, testing, scheduled implementation, verification, and rollback plan. Emergency changes require retroactive review and documentation to preserve auditability.

Configuration drift

Divergence of live system state from the hardened baseline. Unmanaged drift invalidates detection assumptions built on expected configuration and expands the attack surface.

RTO and RPO

Recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss. Both require tested recovery procedures, not just documentation.

Security culture indicators

Phishing simulation report and click rates, helpdesk reports of suspicious email, policy attestation completion, and near-miss reporting volume. Behavior metrics reveal practice beyond stated values.

KPI versus KRI

Key performance indicators measure whether security activities are executed as planned; key risk indicators measure rising exposure. Both need an owner, data source, and reporting cadence.