Summary
Threat intelligence is essential when its value is visible and justified, strategically, operationally, and tactically. As part of the CTI crew, you must select the right metrics to show how valuable the program is. You must also understand IOCs and IOAs to track security events and flows better. In this chapter, we looked at threat intelligence metrics, discussing their requirements and baselines. We also discussed IOCs, their importance, categories, and how to recognize them in a system. We then examined the PoP and its application to adversary activities. The PoP has shown that the amount of pain an adversary can endure depends on the types of indicators you, as the analyst, use. And finally, we reviewed the concept of IOAs, which is important in detecting attacks that might not have visible IOCs.
In the next chapter, we will look at threat intelligence reporting and dissemination, the last phase of the CTI life cycle, before repeating the entire CTI program.
