Using the Pyramid of Pain, how should a city SOC weight a file hash from technical intel versus a tactic from tactical intel?
Select an answer to reveal the explanation.
Short Explanation
Burning a hash is changing a license plate; changing a tactic is learning to drive a different car. Keep the plates in the threat list, but put more weight on detections that catch the driving style. Both matter — the tactic hurts them more.
Full Explanation
The Pyramid of Pain ranks indicators by how costly they are for the adversary to change: technical hashes sit low because a rebuild burns them, while tactical TTPs sit higher and are more durable. Civic SOCs should still load hashes for cheap hits, but they should weight ATT&CK-oriented detections more heavily rather than discarding tactics or pretending hashes never change. Splunk ES can consume both tiers; the pyramid explains why they are not equal.