PECB Certified Cyber Threat Analyst key terms

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and implications, that supports decisions about how to respond to that threat.

A proactive, hypothesis-driven process of searching networks and endpoints for undetected adversary activity, rather than waiting for alerts or automated tools to report it.

A testable statement about adversary behavior expected in the environment, derived from intelligence or attack modeling, that directs what data to collect and query during a hunt.

A forensic artifact such as a file hash, IP address, or domain name that suggests a system may have been breached; useful for detection but easily changed by attackers.

Observable evidence of adversary intent and behavior in progress, such as unusual process execution or lateral movement, which is harder for attackers to alter than static artifacts.

The behavioral patterns describing how an adversary operates: their goals, the methods used to achieve them, and the specific step-by-step implementation of those methods.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform and used to structure hunts and detection coverage mapping.

An analytic framework relating four core features of an intrusion: adversary, infrastructure, capability, and victim, used to pivot between known and unknown elements during analysis.

A phased model of an intrusion from reconnaissance through actions on objectives, used to locate adversary progress and identify where controls can interrupt the attack.

A capability scale describing how organizations progress from relying on automated alerting and external intelligence to leading-edge hunting driven by structured data and original hypotheses.

A document defining the scope, objectives, authority, stakeholders, and reporting lines of a threat hunting program, approved by management before hunting begins.

Pre-agreed boundaries for a hunt or response activity, covering permitted systems, data handling, escalation paths, and actions analysts may take without further approval.

The recorded rationale, data sources, queries, findings, and conclusions for a hunt, enabling reproducibility, peer review, and conversion of results into lasting detections.

A documented set of roles, procedures, and communication paths that guides an organization through detecting, containing, eradicating, and recovering from a security incident.

The repeating phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned that structure handling of security incidents.

A discussion-based simulation in which participants walk through a plausible incident scenario to test plans, decision-making, and coordination without affecting production systems.

A predefined, step-by-step operational guide for handling a specific incident type or hunt pattern, including decision points, escalation criteria, and required evidence collection.

A structured inventory specifying which telemetry sources are needed, their retention periods, and the required quality, used to ensure hunts have sufficient visibility.

Automatically collected data from endpoints, networks, identity systems, and cloud services that records activity and forms the raw material for detection and hunting.

A platform that centralizes, normalizes, correlates, and alerts on log and event data from many sources, providing the search capability hunters rely on.

Endpoint software that continuously records process, file, and network activity and supports investigation and containment actions on individual hosts.

The discipline of designing, testing, tuning, and maintaining detection logic so that it reliably identifies malicious behavior with acceptable false positive rates.

Adjusting detection rules, thresholds, or exclusions to reduce false positives and noise while preserving the ability to catch genuine malicious activity.

An alert or hunt finding that indicates malicious activity when the underlying event is actually benign, consuming analyst time and eroding trust in detections.

A real malicious event that goes undetected because no rule, control, or hunt queried the relevant data or the logic failed to match it.

A model ranking indicator types by how much difficulty their detection causes an adversary, from easily changed hashes at the bottom to hard-to-change TTPs at the top.

A layered approach placing multiple independent preventive, detective, and corrective controls so that failure of one layer does not expose the whole environment.

The principle of granting users, services, and processes only the access rights required to perform their function, minimizing the impact of compromise or misuse.

A controlled process for requesting, assessing, approving, implementing, and reviewing changes to systems and configurations to prevent unintended security or availability impacts.

An approved, documented set of settings for a system or device against which actual configurations are compared to detect drift and unauthorized changes.

The continuous cycle of identifying, prioritizing, remediating, and verifying weaknesses in systems and software based on risk rather than raw severity scores alone.

A platform that integrates security tools and automates repetitive response and enrichment tasks through workflows, reducing manual effort during incidents and hunts.

A structured, ongoing effort to educate staff about threats, policies, and safe behavior, using varied content and measurement rather than one-off annual training.

The shared attitudes, norms, and behaviors of an organization's people regarding security, reflected in how openly errors are reported and how seriously risk is treated.

A controlled exercise sending realistic fake phishing messages to employees to measure susceptibility and reinforce reporting behavior, ideally without punishing those who fail.

Quantitative measures such as mean time to detect or percentage of assets covered by logging, used to track and steer the performance of security processes.

A small set of measures chosen because they reflect progress toward a specific security objective, reported regularly to management to support decisions.

A structured post-incident or post-hunt review that identifies what worked, what failed, and which concrete improvements should be implemented and tracked.

The ongoing cycle of measuring performance, identifying gaps, implementing corrective actions, and verifying their effect, aligned with frameworks such as ISO/IEC 27001 and PDCA.

A maintained record of identified risks with their owners, likelihood, impact, treatment decisions, and status, used to prioritize security work and track resolution.