Summary

In this chapter, we dove into threat actors and highlighted their motivations, their persona types, the threat campaigns they wage, and the tools they use. Then, we moved to how to approach naming from a malware payload, a threat campaign, and even the threat actor itself. Some of the core concepts that you should have picked up on are the types of intelligence that could be collected about threat actors, their campaigns, vulnerability exploitations, and malware. Then, we jumped into naming conventions for threat actors, threat campaigns, malware, and other types of intelligence aligned with the actors. Finally, we discussed threat actor attribution, how to approach it, and its pros and cons.

In the next chapter, we will move into the technical discipline of threat intelligence by offering guidance and discussing threat intelligence policies. Specifically, we will take a deep dive into developing general, focused, and prioritized collection and threat intelligence requirements...