What you'll learn
- The intelligence lifecycle
- Pyramid of Pain
- Using ATT&CK
- From headline to action
Lessons
1The intelligence lifecycle
Direction → collection → processing → analysis → dissemination → feedback. Strategic intel informs executives; operational intel describes campaigns; tactical intel feeds detections.
2Pyramid of Pain
Hashes and IPs are trivial for attackers to change; tools and TTPs are hard. Detections built on behavior last longer than IOC lists.
3Using ATT&CK
ATT&CK organizes adversary behavior into tactics (why) and techniques (how), e.g. T1566 Phishing, T1078 Valid Accounts, T1486 Data Encrypted for Impact. Map your detections to see coverage gaps; use ATT&CK Navigator layers to compare actor profiles with what you detect.
4From headline to action
For every news item ask: Do we run this product? Is it exposed? Is it on CISA KEV? What compensating control applies today? Who owns the fix and by when? The Threat Intel tab in this platform follows that format.
Hands-on lab: Map a real incident to ATT&CK
- Pick an incident from the Threat Intel tab.
- List each attacker action described.
- Map each to an ATT&CK technique ID at attack.mitre.org.
- For each technique, name one log source that would show it.
- Score your environment: detect / partially / no.
Outcome: A coverage gap list tied to a real event.
Practice questions
Top of the Pyramid of Pain (hardest for attackers to change)?
Answer: TTPs. Changing behavior is costly.
T1078 is…
Answer: Valid Accounts. Use of legitimate credentials.
Strategic intelligence is aimed at…
Answer: Executives and decision makers. Long-term risk and trends.
The full graded assessment (4 questions, pass mark 70%) is in the platform.
Key terms
- IOC
- Indicator of Compromise: artifact such as a hash, IP or domain linked to malicious activity.
- TTP
- Tactics, Techniques and Procedures: how an adversary operates.
- Pyramid of Pain
- Model showing that detecting TTPs hurts attackers more than detecting hashes or IPs.
- Diamond Model
- Intrusion analysis model linking Adversary, Capability, Infrastructure and Victim.
- Cyber Kill Chain
- Lockheed Martin model: Recon, Weaponize, Deliver, Exploit, Install, C2, Actions.
- APT
- Advanced Persistent Threat: well-resourced actor, often state-linked, pursuing long-term goals.
- TLP
- Traffic Light Protocol for sharing intel: RED, AMBER, AMBER+STRICT, GREEN, CLEAR.
- KEV
- CISA Known Exploited Vulnerabilities catalog.
- EPSS
- Exploit Prediction Scoring System: probability a CVE will be exploited in the next 30 days.
- STIX/TAXII
- Standards for structuring (STIX) and exchanging (TAXII) threat intelligence.
See the full cyber security glossary →
Official references
Related courses
Security Operations & Incident Response
SIEM, detection engineering, triage, the IR lifecycle and writing a useful post-incident review.
Endpoint Security & Malware Analysis
Hardening, EDR, forensics basics and safe static triage of suspicious files.
Digital Forensics
Evidence handling, Windows and Linux artifacts, memory forensics and building timelines.