Intro to Cyber Threat Intel

Prompts and answers

• What does CTI stand for?
  Cyber Threat Intelligence
• IP addresses, Hashes and other threat artefacts would be found under which Threat Intelligence classification?
  Technical Intel
• At which phase of the CTI lifecycle is data converted into usable formats through sorting, organising, correlation and presentation?
  Processing
• During which phase do security analysts get the chance to define the questions to investigate incidents?
  Direction
• What sharing models are supported by TAXII?
  Collection and Channel
• When an adversary has obtained access to a network and is extracting data, what phase of the kill chain are they on?
  Actions on Objectives
• What was the source email address?
  vipivillain@badbank.com
• What was the name of the file downloaded?
  flbpfuh.exe
• After building the threat profile, what message do you receive?
  THM{NOW_I_CAN_CTI}