A SOC receives a threat-intel report saying a financially motivated ransomware group is targeting healthcare using phishing and encrypted exfiltration. An EDR alert fires for an encoded PowerShell command on an unpatched hospital imaging server. Which concept should the analyst use first to judge alert relevance?

Relevancy is one of the factors CySA+ lists for judging threat intelligence, and the fastest relevancy test is whether the intel describes an adversary that targets organizations like yours. Here the report already names the sector, healthcare, so the analyst's first check is whether the victim's industry and region match the actor's reported targeting. A hospital imaging server fits that profile, which raises the priority of the encoded PowerShell alert and justifies hunting for the actor's known phishing and exfiltration behaviors. Actor motivation explains why the group attacks, but the report has already translated that motive into a target sector, so reasoning from motivation adds a step without adding evidence. Matching the alert to a single malware family is an attribution task that comes later and may fail because ransomware crews rotate tooling. Indicator source type and publication freshness speak to confidence and timeliness of individual indicators, not to whether this threat applies to the organization. On the exam, when a report states who an actor targets, the direct relevancy check is sector and geography match. Operationally, tag intel feeds by sector and region in the threat intelligence platform so matching reports automatically raise the priority of related alerts.