Intro to Cyber Threat Intel

• What does CTI stand for?

Cyber Threat Intelligence

• IP addresses, Hashes and other threat artefacts would be found under which Threat Intelligence classification?

Technical Intel

• At which phase of the CTI lifecycle is data converted into usable formats through sorting, organising, correlation and presentation?

Processing

• During which phase do security analysts get the chance to define the questions to investigate incidents?

Direction

• What sharing models are supported by TAXII?

Collection and Channel

• When an adversary has obtained access to a network and is extracting data, what phase of the kill chain are they on?

Actions on Objectives

• What was the source email address?

vipivillain@badbank.com

• What was the name of the file downloaded?

flbpfuh.exe

• After building the threat profile, what message do you receive?

THM{NOW_I_CAN_CTI}