Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Security OperationsMedium
A SOC analyst is investigating a phishing campaign that successfully compromised several employee credentials. To prevent future similar attacks, the analyst is researching common tactics, techniques, and procedures (TTPs) used by the threat actor, as well as indicators of compromise (IoCs) such as malicious domains and file hashes. Which type of threat intelligence is the analyst primarily utilizing in this scenario?
- AOperational Threat Intelligence
- BTactical Threat Intelligence
- CStrategic Threat Intelligence
- DTechnical Threat Intelligence
Show answer & explanationAnswer & explanation
Correct answer: D. Technical Threat Intelligence
The analyst is focusing on specific, actionable IoCs (malicious domains, file hashes) and TTPs to directly improve defenses against the phishing campaign. This granular, machine-readable information is characteristic of Technical Threat Intelligence, which aids in immediate detection and prevention.
Why the other options are wrong
- A. Operational threat intelligence focuses on the 'who, what, when, where' of attacks, providing context on specific campaigns and adversary TTPs.
- B. Tactical threat intelligence often overlaps with operational and technical, focusing on specific TTPs and attack methodologies relevant to defenders.
- C. Strategic threat intelligence provides high-level insights into an organization's overall threat landscape and attacker motivations.
Technical Threat Intelligence
Actionable, machine-readable information about specific Indicators of Compromise (IoCs) and attacker Tactics, Techniques, and Procedures (TTPs) that can be directly fed into security tools for detection and prevention.
- Includes IoCs: IP addresses, domains, file hashes, URLs.
- Directly usable by security devices (firewalls, SIEM, EDR).
- Aids in immediate detection and blocking of threats.
- Often derived from forensic analysis of incidents.
Memory trick: So Many Tiny Treasures