Cyber Knowledge · Reference index
Concise definitions with direct links to the field-guide sections where each term is used in operational context.
121 source-linked definitions consolidated from the maintained guides. The linked guide section remains the canonical detailed context.
A standardized two-part rating — source reliability A through F, information credibility 1 through 6 — used to grade raw reporting before it's used in analysis. Also called the Admiralty System or the STANAG 2511 model, and codified in the MISP admiral taxonomy for tagging source and claim quality directly on indicators and reports.
A sophisticated, typically state-sponsored or state-aligned actor conducting stealthy, long-term intrusions with defined strategic objectives — intelligence collection, pre-positioning, sabotage — rather than smash-and-grab financial gain. "Persistent" is the operative word: these actors are frequently detected, evicted, and come back with adjusted tradecraft rather than moving on.
Deliberately reproducing a specific tracked actor's TTPs — via tools like Atomic Red Team or MITRE Caldera — to validate whether existing detections actually fire, rather than assuming a written rule works because it looks correct on paper.
Self-hosted CTI-to-detection platform connecting most of the workflow above into one tool: report ingestion, IOC enrichment, ATT CK mapping, malware analysis, attack simulation, and SIEM validation. Its public technique and actor browser, Threat Matrix , is free to use without deploying anything.
a machine- or analyst-generated request for review; not automatically a confirmed threat.
A technique that lists every plausible explanation for the evidence up front — not just the favored one — and evaluates each against the same evidence set simultaneously, looking for what would disconfirm each hypothesis rather than what confirms it. The goal is to catch the case where evidence looks supportive of a theory mainly because no competing theory was ever seriously tested.
logic that transforms or evaluates data to identify a defined condition or behavior.
Systematic errors in judgment that structured techniques and peer review are designed to catch: confirmation bias (treating every new overlap as support for the actor hypothesis already in the analyst's head), anchoring (over-weighting the first vendor label or first incident-response theory), mirror-imaging (assuming the adversary values risk and cost the way the defender does), availability bias (over-weighting the most memorable recent campaign), and groupthink (converging on a shared label because peers use it, without separately testing the evidence).
a file, memory region, configuration, packet capture, log, or derived object preserved for analysis.
Plotting your organization's detections against the ATT CK matrix to visualize gaps and prioritize new detection engineering work — the same layout you can explore for free on Threat Matrix , or connect to a live detection backlog in AdversaryGraph .
A web tool for visualizing, annotating, and comparing coverage across the ATT CK matrix — for example, an actor's known techniques versus your detections. Threat Matrix is a free public instance of this same idea, pre-loaded with actor and technique data.
interfaces, states, identities, data paths, and dependencies through which a security boundary can be influenced.
The process, and inherent difficulty, of tying an intrusion to a specific actor or sponsor. Usually expressed with an explicit confidence level, since false flags, shared tooling, and leaked or resold malware make certainty rare. See Threat Actor / Group / Campaign in Module 1 for the full evidence hierarchy, illustrated with actor profiles on Threat Matrix .
action performed or attempted by code in a stated context.
expected legitimate behavior that genuinely matches the described behavior and may require contextual handling.
what code appears able to do; not necessarily reached or executed.
the durable work record that groups evidence, hypotheses, decisions, actions, owners, and state.
A separate axis from probability: confidence reflects the quality, access, and corroboration of the underlying sourcing, not the likelihood of the conclusion itself. A judgment can be likely but low confidence if the evidence is thin, or high confidence but still short of certain.
data that controls endpoints, identifiers, features, timing, keys, or execution conditions.
authorized action that limits current or expected harm while preserving a path to recovery and investigation.
the set of inputs used and evolved by a fuzzer.
an evidence-backed state for a specific behavior, environment, data source, analytic, test, workflow, and limitation.
a triage fingerprint; useful for grouping but not equal to root cause.
Entry-level roles often focus on indicator triage and enrichment (tactical/technical) — the Indicator Enrichment Scoring and Admiralty Code work from Modules 5 and 7. Senior roles move toward actor tracking, campaign analysis, and strategic reporting — the Threat Actor Profile and Finished Intelligence work from Module 7, built on the analytic discipline in Module 5.
identifier and record for a specific publicly disclosed vulnerability.
framework for communicating vulnerability severity characteristics; v4.0 includes Base, Threat, Environmental, and Supplemental groups.
community-developed vocabulary of software and hardware weakness types.
A seven-stage intrusion model — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command Control, Actions on Objectives — used to identify where a defense can break the attack. Developed by Lockheed Martin as part of Intelligence Driven Defense, it remains useful mainly as an organizing structure for evidence, not as a claim about what actually happened at every stage.
Evidence-based knowledge about existing or emerging threats — actors, capabilities, infrastructure, and intent — that supports a specific decision. Intelligence is not raw data; it is data that has been collected, evaluated, and interpreted for a consumer to act on. A firewall block list of IP addresses is data. A profile explaining who is behind those addresses, what they are after, what they have already compromised elsewhere, and how they are likely to adapt once blocked is intelligence.
Collection from restricted-access forums, marketplaces, and Telegram/Discord channels where criminal actors trade access, tools, and stolen data. This is where initial access brokers advertise footholds, where breached credentials surface before an organization even knows it was compromised, and where ransomware affiliates coordinate outside the reach of standard OSINT tooling.
documented source, schema, field, time, quality, ownership, and change expectations.
Data is a raw, unprocessed observation: a log line, a hash, an IP address someone saw once. Information is data organized into context — a list of IPs grouped under "seen in this campaign." Intelligence is information analyzed against a specific requirement to produce an assessment a decision-maker can act on. The step that actually matters is the last one, and it is the one most self-taught analysts skip: turning a pile of correlated observations into a claim you would defend under questioning.
tool that reconstructs higher-level pseudocode from machine code; output is an interpretation, not original source.
version-controlled analytic source, tests, metadata, review, deployment, and lifecycle management.
The point where CTI's tactical output — a TTP, a new IOC set, an actor profile — becomes an engineering backlog item with defined telemetry requirements and validation criteria, instead of a report that gets read once and filed away.
a high-level approach that organizes analytics for a behavior in a given context.
A model that represents every intrusion event as four connected vertices — Adversary, Infrastructure, Capability, and Victim — used to pivot between known facts and discover new ones. Its strongest use isn't drawing the diagram; it's testing whether the links between vertices are actually supported by evidence.
distinct roles for placing, loading, and performing primary functionality; one artifact can combine roles.
observation of runtime behavior in a controlled environment.
probability estimate for observed exploitation activity in the next 30 days; not a complete risk score.
removal of malicious artifacts, persistence, exposed trust, and exploited root causes after scope is understood.
CTI collection must stay within authorized scope and applicable law — accessing systems without authorization, even for "research," is illegal regardless of intent. The same discipline applies to attribution: naming an actor or a sponsor is an analytic judgment, not a legal or government determination, and should be written and hedged accordingly.
whether a weakness can be turned into a useful security impact under stated conditions.
a detector match that satisfies rule logic but does not represent the target condition under the label policy.
analyst/vendor grouping of related malware based on defined shared features.
Refined, analyzed intelligence output ready for a consumer, as opposed to raw data — spans flash/tactical alerts, actor profiles, and long-form strategic assessments. Research notes capture what an analyst found; finished intelligence explains what it means, how confident the analyst is, what's still unknown, and what action should follow.
The workflow of translating an adversary behavior into a written detection, commonly expressed in Sigma (generic), YARA (file/memory pattern matching), or Snort/Suricata (network) formats. AdversaryGraph 's Attack Simulation module then validates whether that rule actually fires.
Politically or ideologically motivated cyber activity — defacement, DDoS, leaks, hack-and-leak operations — aimed at making a statement, applying pressure, or shaping a narrative rather than direct financial gain. Attribution is often harder here than with financially motivated crime, since the "statement" itself is part of the operation and personas are frequently built to obscure sponsorship.
adapter that presents target functionality to a fuzzer or test engine.
Deliberately vulnerable systems or networks deployed to attract, observe, and collect intelligence on attacker behavior. A honeypot is a single decoy asset; a honeynet is a connected set of them designed to look like a real network segment, giving an intruder enough room to reveal tooling and lateral-movement habits rather than just an initial exploit attempt.
Adjacent intelligence disciplines — Human, Signals, Geospatial, and Technical intelligence — that CTI sometimes draws on or parallels in tradecraft, mostly inherited from the traditional intelligence community rather than practiced directly by most CTI teams. HUMINT is intelligence from human sources (undercover forum access, informants); SIGINT is intercepted communications and signals; GEOINT is imagery and geospatial analysis; TECHINT is intelligence derived from adversary technical materiel — captured tools, malware, or hardware.
Adding context — first/last seen, confidence, related campaigns, source rating, TLP marking — to raw indicators so downstream consumers can prioritize and act on them instead of receiving an undated, unsourced list of hashes and domains, which is closer to an IOC dump than to intelligence.
An IOA is a behavior or sequence assessed as consistent with attack activity, independent of one static artifact — for example, "an Office process spawns a script interpreter, which then makes an outbound connection to a newly registered domain." It may reveal preparation, attempted execution, or activity in progress; like any analytic signal, it requires context and validation. No known hash is required because the pattern is the indicator.
An IOC is an observable artifact — a hash, an IP address, a domain, a mutex, or a registry key — assessed as associated with malicious activity. It may support prevention, detection, scoping, or retrospective investigation, but it does not prove compromise by itself. Many IOCs are easy to collect and share, and static values can be inexpensive for an adversary to replace after disclosure.
A specialized criminal actor who breaches organizations and then sells that access to other threat actors — often ransomware affiliates — rather than exploiting it directly. IABs are the wholesale layer of the intrusion economy: they turn "we found a way in" into a tradeable commodity, decoupling initial compromise from whatever happens next.
Risk originating from someone with legitimate access — malicious, negligent, or compromised — rather than an external adversary. It's the category CTI tends to under-serve relative to its impact, since most CTI tradecraft (IOCs, infrastructure pivoting, actor tracking) assumes an outside intruder to track.
SIEM, EDR, firewall, and proxy logs from your own environment — often the most relevant and highest-fidelity CTI source for your specific organization, and the one every other collection source in this module is ultimately in service of: external intelligence only matters once it can be checked against what your own systems actually recorded.
security property that must remain true across states and transitions.
observable value used as an investigation lead; quality depends on role, context, confidence, and time.
Information Sharing and Analysis Center/Organization — sector-specific (e.g. FS-ISAC for finance) or cross-sector communities for sharing threat intelligence among trusted peers, usually under a traffic-light-style handling protocol that governs how far a given piece of intelligence can be re-shared.
identity threat detection and response across accounts, sessions, credentials, permissions, devices, applications, and trust.
CISA catalog of vulnerabilities with evidence of known exploitation.
Following relationships between entities — domains, IPs, certificates, WHOIS registrants, malware hashes — to expand a single indicator into a broader picture of adversary infrastructure. This is what AdversaryGraph's IOC investigation graph is built to do interactively, turning a manual, tab-by-tab pivoting habit into a visual, queryable graph.
A link-analysis and visualization tool for graphing relationships between entities during infrastructure pivoting and OSINT investigations — turning a list of pivots into a graph an analyst can actually read.
Automated dynamic analysis — detonating a sample in an isolated environment — as a collection source for behavioral IOCs and TTPs. Where static analysis reads a file without running it, sandboxing runs it deliberately, on the assumption that a sample's real behavior is harder to fake than its static appearance.
Malware Behavior Catalog, a behavior vocabulary tailored to malware analysis and related to ATT CK concepts.
Model Context Protocol, used to expose structured resources and tools to compatible AI applications.
cross-process or in-process placement/execution of code; requires more evidence than an executable memory permission.
reducing an input while retaining the same failure and root cause.
An open-source threat intelligence platform for storing, correlating, and sharing IOCs and threat data, including "galaxies" of actor and malware taxonomy. MISP is also where a source-grading standard becomes executable rather than just a table in a document: the CTI Analyst Field Manual notes that the Admiralty Code covered in Module 5 "is also codified in the MISP admiral taxonomy," letting a team tag source reliability and information credibility directly on the objects being shared instead of tracking it separately.
An ATT CK-style knowledge base specifically for adversarial threats against AI and machine-learning systems — prompt injection, training-data poisoning, model extraction, and the rest of the AI-specific attack surface, cataloged with the same tactic/technique structure as classic ATT CK.
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, organized as a matrix (Enterprise, Mobile, ICS) and used as the common language for describing behavior. Module 1 covers how tactics, techniques, and sub-techniques actually decompose using the T1003/T1003.001 example; this entry is about the framework itself as a shared standard.
A knowledge graph of defensive techniques mapped to the offensive techniques they counter, complementing ATT CK from the defender's side — where ATT CK answers "what did the adversary do," D3FEND answers "what specific defensive control actually counters that."
network detection and response using flow, protocol, packet, DNS, proxy, gateway, and related context.
An open-source platform for structuring, storing, and visualizing threat intelligence knowledge as a connected graph, with native STIX 2.1 support and a GraphQL API for all read/write operations. See the Threat Intelligence Platform entry in Module 7 for how this fits alongside MISP and commercial TIPs.
Intelligence about specific campaigns, operations, targeting, and near-term adversary activity, used to anticipate and prepare for a particular threat — one level more concrete than strategic trend-watching, one level less granular than the individual technical artifacts a detection engineer works with. This is the altitude where a tracked campaign becomes the unit of analysis: not "ransomware is a growing risk" (strategic), and not "block this specific hash" (technical), but "this campaign is currently active against our sector and is likely to reach us within weeks."
mechanism that identifies a failure, such as a sanitizer, assertion, differential result, or invariant check.
Intelligence derived from publicly available sources: news, social media, forums, code repositories, certificate transparency logs, and more. The hard part was never finding a single public data point — it's querying dozens of scattered sources, correlating what they return, and doing it without tipping off the target.
transformation that wraps/compresses/encrypts an executable and restores code at runtime.
A historical record of DNS resolutions over time, used to pivot from a known-bad domain to related infrastructure without directly querying the adversary's systems. Infrastructure Pivoting calls it "the history book of the internet" for a precise reason: recursive DNS resolvers log every question and answer — domain X resolved to IP Y at timestamp Z — and those logs accumulate for months or years into a record that survives infrastructure rotation.
relevant reviewed matches divided by reviewed matches for a defined population and label policy.
attacker-influenced capability such as read, write, call, lifetime control, or unauthorized state transition.
A PIR is the specific, stakeholder-defined question that drives what a CTI team collects and analyzes — for example, "is our sector being targeted by ransomware affiliates this quarter?" PIRs sit at the top of a small hierarchy: a PIR is the high-level question tied to a decision, a Specific Intelligence Requirement (SIR) breaks that question into answerable sub-questions, and an Essential Element of Information (EEI) defines the concrete, collectible information needed to answer a SIR.
documented origin and transformation history of an artifact or claim.
product security incident response team that receives, coordinates, remediates, and communicates product vulnerabilities.
A collaborative exercise where red team (attack) and blue team (defense) work together in real time to validate and improve detection coverage, rather than operating as adversarial, siloed exercises where a red team report lands weeks later with the operational context already gone.
David Bianco's model ranking indicator types by how much cost it imposes on an adversary to change them when detected — trivial (hash values) at the bottom, painful (TTPs) at the top. Module 1 covers this in depth from the indicator side: see IOC and IOA for what sits at the bottom and top of the pyramid respectively, and why that ranking should drive where a CTI team actually invests detection effort.
retrieval-augmented generation, in which authorized source material is retrieved as context for a model.
A criminal business model where ransomware developers lease their malware and infrastructure to "affiliates," who conduct the actual intrusions and split the extortion proceeds with the developer. RaaS is what turned ransomware from a bespoke capability a handful of groups had into a commodity service almost any capable intruder can rent.
detected relevant instances divided by all relevant instances in a labeled evaluation population.
Start with the intelligence cycle in Module 2 and ATT CK in Module 3 — browse ATT CK hands-on on Threat Matrix — then practice collection and indicator pivoting in Module 4 , learn a structured analytic technique in Module 5 , study the actor landscape in Module 6 , and build toward finished-intelligence writing and CTI-to-detection handoff in Module 7 and Module 8 inside a platform like AdversaryGraph .
restoration and verification of service and trust, with monitoring and residual-risk communication.
Options include GCTI (SANS/GIAC Cyber Threat Intelligence) and CTIA (EC-Council), plus broader analyst certifications like GCFA or OSCP for adjacent skill depth. None of these substitute for published, reviewable analytic work — a certification demonstrates you learned the material; a public actor profile or a defended attribution judgment demonstrates you can apply it.
The foundational doctrine of intelligence analysis, credited to Sherman Kent's work professionalizing U.S. intelligence analysis: separate observed fact from assumption and judgment, use estimative language deliberately, state confidence apart from probability, and make the analytic path auditable rather than asserting a conclusion and hoping it's trusted.
Internet-wide scanning search engines used to discover exposed services, adversary infrastructure, and misconfigured assets, indexed continuously rather than queried live against the target each time.
The discipline of adjusting the same underlying finding for different audiences — an executive summary versus a SOC-facing technical bulletin versus a detection engineer's telemetry requirements — without changing the underlying judgment or quietly dropping the uncertainty that qualifies it.
inspection without executing the artifact.
STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence as structured data. TAXII (Trusted Automated Exchange of Intelligence Information) is the transport protocol used to share it between platforms — STIX defines the shape of the data, TAXII defines how it moves. STIX 2.1 and TAXII 2.1 are the current published OASIS Standards.
High-level, non-technical intelligence for executives — trends, geopolitical drivers, and business risk — usually with a long time horizon and framed in decision language rather than activity language. The question a strategic product answers isn't "what did the SOC do this month," it's "what should leadership decide, and why."
A family of formal methods — Analysis of Competing Hypotheses, Key Assumptions Check, Red Team analysis, premortems — used to inject deliberate friction into analysis so a conclusion has to survive scrutiny before it ships. They exist because unstructured analysis tends to converge on whatever hypothesis felt right first, then collects evidence to support it rather than test it.
Actor TTPs and behavior patterns used to build detections and inform hunting — the analyst- and engineer-facing layer, and the altitude where most of the day-to-day CTI-to-detection handoff actually happens. A tactical product isn't "watch out for ransomware" or "block this IP"; it's "this actor's confirmed TTPs are X, Y, and Z, here is the telemetry needed to hunt for them, and here is the detection backlog item that should come out of it."
TTPs are the "how" of an adversary, described at three levels of resolution. A tactic is the goal, not a step — "why" the adversary is doing something (e.g. Credential Access, Persistence). A technique is the specific method used to accomplish that goal. A procedure is the exact implementation a given actor uses — the specific tool, the specific command line, the specific order of operations.
The most granular layer: raw IOCs , malware samples, and infrastructure data, often machine-consumable and the fastest to go stale. This is the layer the Pyramid of Pain puts at the bottom for exactly the reasons covered in Module 1 — cheap to produce, cheap for an adversary to invalidate — but it is also the raw material every other altitude of intelligence is ultimately built from.
evidence that source generation, collection, transport, parsing, storage, and query remain usable.
The repeatable production process — Direction, Collection, Processing, Analysis Production, Dissemination, Feedback, and Refinement — that turns a stakeholder question into a usable product. It matters because threat reporting is noisy by default: without a cycle, analysts collect whatever looks interesting and go searching for a use case afterward. With one, every piece of collection traces back to a requirement, and every finished product traces forward to the decision it is meant to support.
A threat actor is an individual or group conducting malicious activity. A threat group is a tracked cluster of activity attributed, with varying confidence, to a common actor — "cluster" is the operative word, because what analysts actually observe is correlated behavior, not a verified identity. A campaign is a bounded set of operations sharing goals, timeframe, or infrastructure, which may or may not map cleanly onto a single group.
Different vendors track — and name — the same underlying activity differently: Mandiant (APTxx / UNCxxxx), CrowdStrike (animal + adjective, e.g. "Fancy Bear"), Microsoft (weather names, e.g. "Midnight Blizzard"), MITRE ATT CK (Gxxxx group IDs). None of these are the "real" name — they're independent clustering judgments that sometimes converge on the same activity and sometimes don't.
A finished-intelligence product consolidating everything known about a tracked group — TTPs, targeting, tooling, alias crosswalk, and history — as a reference for analysts and detection engineers. Threat Matrix publishes these as browsable public pages; AdversaryGraph adds sector relevance scoring on top.
a planned, bounded investigation that tests a hypothesis against available evidence.
A falsifiable statement — "if actor X is present, telemetry Y should show Z" — derived from CTI, used to proactively search for compromise that automated detections may have missed.
Structured streams of indicators or reports, from open-source (abuse.ch, ThreatFox), commercial (vendor feeds), or community (ISAC/ISAO) sources — the closest thing CTI has to a raw-material supply chain, and the layer most teams over-invest in relative to what it can actually deliver on its own (see IOC in Module 1 for why).
Software used to aggregate, correlate, enrich, and disseminate threat intelligence — e.g. MISP, OpenCTI, ThreatConnect, Anomali, or the self-hosted AdversaryGraph . The core job is the same across all of them: turn scattered feeds and reports into a queryable, correlated store instead of a pile of disconnected spreadsheets and PDFs.
A threat is a potential cause of harm — an actor or an event. A vulnerability is a weakness that could be exploited. Risk is the likelihood and impact of a threat actually exploiting that vulnerability against a specific asset you own. Said as one sentence, that sounds obvious. Said as a scanner output with 400 "Critical" findings and one Tuesday to triage them, it is the difference between a defensible prioritization and a wall of red numbers nobody trusts.
FIRST's current TLP 2.0 standard defines four labels — TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR — plus the TLP:AMBER+STRICT sharing caveat. The marking tells a recipient how widely a piece of intelligence may be shared. It is one of the simplest CTI conventions to explain and one of the easiest to get wrong in practice, because the label has to travel with the content through every re-share and summary, not just the original document.
recovering and validating the representation used after a packing transformation.
search for the same weakness pattern in related code, interfaces, branches, or products.
The Vocabulary for Event Recording and Incident Sharing: a common, structured vocabulary for describing security incidents consistently — actors, actions, assets, and attributes — so incidents from different organizations can be aggregated and compared rather than read as one-off prose narratives. It's the structural backbone behind large-scale, data-driven incident analysis such as the annual Verizon Data Breach Investigations Report.
A multi-engine scanning and enrichment service for files, URLs, domains, and IPs, widely used for first-pass indicator triage — the fastest way to check whether an artifact is already known-bad before spending analyst time on it.
Standardized language — "almost certainly," "likely," "roughly even chance," "unlikely" — that maps qualitative confidence to a consistent probability band across a team, so "likely" means the same thing in every report a given team publishes instead of drifting with each analyst's personal sense of the word.
A pattern-matching tool for identifying and classifying malware samples based on textual or binary signatures — the standard way to say "this file matches a known malware family" in a form other tools and platforms can consume directly.
pattern language and engine for identifying/classifying files or memory using strings, metadata, modules, and conditions.