A city SOC inventories only file hashes from a library incident and has no technique IDs. What must it add before it can describe the campaign in the industry's common TTP language?
Select an answer to reveal the explanation.
Short Explanation
A drawer full of fingerprints is not a playbook. Hashes are clues; ATT&CK technique IDs are the shared language other SOCs use to say what the actor actually did.
Full Explanation
To describe a library incident campaign in the industry's common TTP language, the city SOC must add MITRE ATT&CK technique IDs that name the behaviors. File hashes are valuable IoCs for blocking and pivoting, but they are not the shared vocabulary other SOCs, ISACs, and Enterprise Security annotations use to say what the adversary did. Without technique IDs, the inventory stays at the fingerprint drawer and never becomes a playbook other civic defenders can reuse.
Exporting a longer hash list from the library print-server fails by mistaking more IoCs for ATT&CK coverage—quantity of hashes does not create technique mapping. Storing Kill Chain stage numbers as CIM sourcetypes so hashes "become tactics" fails by conflating campaign-stage models, data models, and ATT&CK techniques; CIM does not auto-promote hashes into tactics. Substituting Diamond Model victim names for technique mapping fails by swapping victim identity for adversary method—useful for Diamond analysis, but not a replacement for ATT&CK technique IDs.
Exam caveat: IoCs ≠ TTPs. SPLK-5001 expects candidates to elevate from hashes to technique IDs before claiming industry-standard TTP description.
Operational check: for each confirmed library behavior (for example malicious document execution, credential dumping, C2), assign the matching ATT&CK technique ID, annotate the related ES detections, and keep hashes in threat-intel lookups as enrichment—not as the sole campaign language.