Select Two (Multi-Select) Questions

valid_from

Validity dates are standard properties.

confidence

Confidence levels are standard for assessing indicator reliability.

pattern

The pattern is the core of the indicator.

Mitigation suggestions

Mitigation helps the team react to the threat.

Actionable Indicators (IOCs)

IOCs are essential for operational teams.

number_observed

Frequency is a key attribute of sightings.

last_observed

Timeframe is critical for observed data.

first_observed

Timeframe is critical for observed data.

Defense Evasion

Required to hide the persistence mechanism.

Persistence

Directly required to keep the foothold.

Privilege Escalation

Required to gain the rights needed to install persistence.

Tasking collection assets and monitoring the flow of raw intelligence data

Tasking sources and overseeing data flow are core operational responsibilities of collection management.

Identifying and evaluating intelligence sources and collection feeds against stated PIRs

Matching sources to PIRs ensures the collection mechanism is targeted and effective.

SHA-256 File Hash

File hashes are classic atomic IOCs.

C2 Domain name

Known bad domains are classic network IOCs.

The timeliness of the intelligence.

Old intelligence may no longer be relevant.

The historical accuracy of the source.

Consistent accuracy builds reliability.

Corroboration from other independent sources.

Multiple sources agreeing increases confidence.

Sensitive file access and data movement tracking.

Detects unauthorized exfiltration.

System authentication and login/logout logs.

Detects unusual sign-in times/locations.

Email or messaging communication traffic metadata.

Detects suspicious communications.

The ephemeral nature of cloud assets

Assets like containers exist for short times, making them hard to track.

Shared responsibility model complexity in attribution

Determining if an incident is the provider's or customer's fault is difficult.

Access Control Lists (ACLs)

ACLs define who can read from or write to the collection.

Content filtering criteria

Content filtering ensures only authorized intelligence is exposed to specific consumers.

Aggregating and deduplicating indicators from multiple sources

Deduplication is essential during processing to reduce noise.

Decrypting encrypted intelligence feeds

Decryption is required before data can be analyzed.

Normalizing data into a standard schema (e.g., STIX)

Normalization is a critical processing task.

To indicate the source of the observation

Sightings include source/observer information.

To provide evidence that an indicator was observed

This is the primary function of a Sighting.

To define the count of how many times it was seen

The count field is a standard part of the Sighting object.

Enrichment with context

Adds value to the raw data.

Normalization of data formats

Ensures consistency across different feeds.

Deduplication of entries

Removes noise and improves efficiency.

Intrusion Set / Threat Actor identity

The actor profile is the primary component of this node.

Adversary motivation

Motivation is a core component of the adversary node.

Centralizing threat data from multiple disparate sources

Centralization is the core purpose of a TIP.

Automating the distribution of indicators to security controls

Integration and automation are key benefits of a TIP.

Executive Leadership and Risk Management (CISO, CRO)

Executives provide strategic context and require risk-aligned intelligence reporting.

Security Operations Center (SOC) managers

SOC managers need intelligence feeds and detection rules to tune security alerts.

Incident Response (IR) team leads

IR teams provide operational feedback on attacker TTPs and require tactical/operational intelligence.

Tactical level (SIEM systems, Automated security controls, SOC analysts)

Tactical consumers require indicators of compromise, file hashes, and IP blocklists.

Strategic level (Executive leadership, Board of Directors)

Strategic consumers require high-level threat trends, risk context, and geopolitical insights.

Operational level (Security Operations Center managers, Incident Responders)

Operational consumers require campaign information, actor attribution, and TTP details.

Analyst professional development, training, and industry certifications

Training and certifications for analysts are essential personnel budget items to maintain analytical capability.

Threat intelligence sharing memberships (e.g., ISACs, ISAOs)

ISAC and ISAO memberships incur fees that must be budgeted for sector threat collaboration.

Commercial threat intelligence feed subscriptions and Threat Intelligence Platforms (TIP)

Subscriptions and TIP software licenses represent core tooling expenses for a CTI program.

Initiate threat hunting across endpoints

Check for latent infections.

Validate against internal historical logs

Check if the indicator has appeared previously.

Automate blocking at the perimeter

Apply proactive protection.

Capability

The tools/techniques used.

Infrastructure

The network resources used.

Adversary

The entity performing the attack.