📖 What is Threat Intelligence?
Threat Intelligence is the collection and analysis of information about current and potential attacks that target an organization. This data is used to understand the motives, targets, and behaviors of threat actors to proactively strengthen defenses.
"Look for terms like "Indicators of Compromise (IoC)" and "TTPs (Tactics, Techniques, and Procedures)" when identifying threat intelligence concepts."
📚 Certification: CompTIA Security+ Certification Exam (SY0-701)
🔑 What are the Key Concepts of Threat Intelligence?
- ▸ Indicators of Compromise (IoCs) are technical artifacts, such as malicious IP addresses or file hashes, that signal a potential security breach.
- ▸ Tactics, Techniques, and Procedures (TTPs) describe the behavioral patterns and methodologies used by threat actors to execute their attacks.
- ▸ Threat feeds provide automated, real-time streams of intelligence from various sources to update security tools like firewalls and SIEMs.
- ▸ Intelligence levels are categorized as Strategic (high-level), Operational (campaign-focused), and Tactical (technical indicators) to serve different organizational roles.
- ▸ The Diamond Model and Cyber Kill Chain are frameworks used to analyze the relationship between adversaries, infrastructure, and attack stages.
🎯 How does Threat Intelligence appear on the SY0-701 Exam?
A scenario might provide a list of known malicious domains and file hashes, asking you to identify these specific artifacts as Indicators of Compromise (IoCs) used for immediate blocking.
You may be asked to distinguish between intelligence levels when a C-level executive requires a high-level report on emerging global threats to inform the annual security budget and strategic planning.
Expect questions about the integration of automated threat feeds into a SIEM or SOAR platform to enable proactive detection and automated blocking of known adversary infrastructure across the enterprise network.
❓ Frequently Asked Questions
What is the primary difference between an IoC and a TTP?
IoCs are static artifacts, like a specific IP address, which are easy for attackers to change. TTPs describe the behavioral patterns of an attacker, which are much harder to alter and provide deeper insight.
When should an organization use Strategic Intelligence versus Tactical Intelligence?
Use Strategic Intelligence for long-term planning and risk management at the executive level. Use Tactical Intelligence for immediate technical responses, such as updating firewall rules to block a specific malicious IP.