Digital Forensics and Incident Response - Second Edition

Threat intelligence types

When discussing the wide variety of information types and datasets that constitute threat intelligence, they often fall into one of three main categories:

• Tactical threat intelligence: This is the most granular of the three threat intelligence categories. Information in this category involves either Indicators of Compromise (IOCs), Indicators of Attacks (IOAs), or Tactics, Techniques, and Procedures (TTPs):
  • IOCs: An IOC is an artifact observed on a system that is indicative of a compromise of some sort. For example, a C2 IP address or an MD5 hash of a malicious file are both IOCs.
  • IOAs: An IOA is an artifact observed on a system that is indicative of an attack or an attempted attack. This can be differentiated ...