Glossary
The terms this whole field runs on, in plain language. Useful whether you're brand new or just need a quick refresher.
Threat Actor
An individual or group responsible for an attack or campaign, which could be a criminal group, a nation-state, a hacktivist, or an insider. It's a deliberately broad term, used when attribution isn't fully known or doesn't need to be specified.
APT (Advanced Persistent Threat)
A threat actor, usually nation-state-linked, who gets into a network and stays, quietly, for a long time to achieve a specific goal (espionage, sabotage) rather than a quick smash-and-grab. Often given a tracking name or number (e.g. APT34) by whoever first identified them.
Campaign
A set of related attacks or activity, usually against multiple targets, tied together by shared infrastructure, tooling, or objective. Analysts cluster individual incidents into a campaign once the connections are clear.
TTP (Tactics, Techniques, and Procedures)
How an adversary operates, at three levels of specificity: Tactics are the why (e.g. gain initial access), Techniques are the how (e.g. phishing), and Procedures are the exact steps a specific actor takes. TTPs are the hardest thing for an attacker to change. See the Pyramid of Pain on Where to Start.
IOC (Indicator of Compromise)
Forensic evidence that something bad happened or is happening: a malicious file hash, IP address, domain, or URL. IOCs are easy for an attacker to change, so they're useful for detection but not very durable.
IOA (Indicator of Attack)
Similar to an IOC, but focused on behavior and intent rather than a static artifact, e.g. "this process is trying to dump credentials" rather than "this specific file hash is bad." IOAs tend to catch attacks earlier and survive an attacker changing their tools.
Attribution
The process (and the resulting judgment) of determining who is responsible for an attack. Genuinely hard, and usually stated with a confidence level (low, moderate, high) rather than certainty.
Indicator
A general term for any observable that might signal malicious activity, covering both IOCs and IOAs, and more.
Pivoting
Using one piece of information to find related pieces, e.g. taking a malicious domain and finding every other domain registered with the same email address. Pivoting is how isolated incidents get connected into a bigger picture.
Enrichment
Adding context to a raw indicator: where is this IP located, who owns this domain, has this hash been seen before, is it linked to a known threat actor. Enrichment turns "here's a hash" into "here's a hash, and here's what it means."
TIP (Threat Intelligence Platform)
Software built to collect, correlate, and manage threat data at scale: the analyst's central workspace for indicators, reports, and relationships. See the Tools page for real examples.
Sandbox
An isolated environment where you can safely detonate a suspicious file or URL and watch what it actually does, without risking your real systems.
Passive DNS
A historical record of what domain names have resolved to what IP addresses over time. Useful for spotting infrastructure reuse an attacker might not realize connects two seemingly unrelated incidents.
OSINT (Open-Source Intelligence)
Intelligence gathered from publicly available sources: social media, news, forums, breach databases, even a company's own job postings. A huge amount of CTI work is OSINT.
Want frameworks, a self-check, and a hands-on exercise too? Where to Start has all of it.
Go to Where to Start →