A threat intelligence analyst receives a report from an ISAC (Information Sharing and Analysis Center) containing a list of IP addresses, domains, and file hashes associated with a threat actor targeting the energy sector. How should this intelligence be prioritized for operationalization?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to check whether the threat actor actually targets your sector, technology, and geography before acting. Then operationalize the highest-confidence, longest-lived indicators first, starting with TTPs over domains, IPs, and hashes.
Full Explanation
Apply the Diamond Model or MITRE ATT&CK mapping to assess relevance — does the threat actor target our sector, technology, and geography? — then prioritize operationalizing the highest-confidence, lowest-decay-rate indicators (TTPs > domains > IPs > hashes) based on the organization's defensive tooling. Not all threat intelligence is equally relevant; assessing actor targeting determines applicability. The Pyramid of Pain prioritization — TTPs are hardest for attackers to change and should drive detection rules; domains and IPs are lower-value and higher decay — guides which indicators to operationalize first and how. Sharing the report externally on social media is wrong because sharing ISAC intelligence externally without authorization violates TLP sharing restrictions. Blocking all indicators immediately is wrong because blind blocking without relevance assessment risks blocking legitimate services. Filing the report for quarterly review is wrong because quarterly review delays actionable intelligence that may be relevant to imminent attacks.