An ISAC bulletin describes a campaign expected against U.S. water utilities over the next quarter and lists likely TTPs. Which intelligence tier is that for the city's water SOC?
Select an answer to reveal the explanation.
Short Explanation
A quarter-long campaign with likely plays is the game plan, not the season recap and not a single jersey number. That is operational intel: window, target sector, TTPs to plan against. A lone hash is technical; a board white paper is strategic.
Full Explanation
An ISAC bulletin describes a campaign expected against U.S. water utilities over the next quarter and lists likely TTPs. For the city's water SOC, that is operational intelligence for a time-bounded campaign and its likely TTPs. Civic framing matters because water utilities are critical municipal infrastructure; a quarter-scoped campaign bulletin should drive near-term hunts and detection priority, not only a multi-year board paper or a single hash load.
Calling it strategic intelligence that only answers multi-year board questions fails by concept: strategic intel addresses long-horizon intent and risk appetite, whereas this bulletin is a time-bounded sector campaign with actionable TTPs. Treating it as technical intelligence consisting solely of one file hash fails by concept: technical intel is indicator-centric, and a campaign-plus-TTP bulletin is broader than one hash. Calling it an Enterprise Security annotation that fires notables by itself fails by concept: annotations are detection metadata and do not generate alerts from an ISAC PDF.
Exam caveat: SPLK-5001 expects operational intel when the product is a campaign window plus likely TTPs for defenders—do not collapse that into strategic-only or single-hash technical intel.
Operational check: Translate the water-sector bulletin into a quarter-scoped hunt plan mapped to the listed TTPs in Splunk ES, schedule coverage gaps, and keep board-level strategic narrative separate from this campaign response.