312-39V2: Certified SOC Analyst v2

Question

Which of the following types of threat intelligence does a SIEM use to provide analysts with context and “situational awareness” through threat actor TTPs, malware campaigns, and tools employed by threat actors?

Strategic threat intelligence
Tactical threat intelligence
Operational threat intelligence
Technical threat intelligence

Explanation

Tactical threat intelligence describes adversary TTPs and tools in a form that supports detection and defensive operations. Operational threat intelligence adds the context of specific campaigns and threat-actor activity. Combined, they enable analysts to correlate observed events with known adversary behavior and campaigns; strategic intelligence is executive-level context, while technical intelligence is primarily indicator-level data.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ149

Community Discussion