Glossary
All the acronyms and jargon this field runs on, in plain English. Handy if you're brand new or just need a quick refresher.
Threat Actor
An individual or group responsible for an attack or campaign, which could be a criminal group, a nation-state, a hacktivist, or an insider. It's a deliberately broad term, used when attribution isn't fully known or doesn't need to be specified.
APT (Advanced Persistent Threat)
A threat actor, usually nation-state-linked, who gets into a network and stays, quietly, for a long time to achieve a specific goal (espionage, sabotage) rather than a quick smash-and-grab. Often given a tracking name or number (e.g. APT34) by whoever first identified them.
Campaign
A set of related attacks or activity, usually against multiple targets, tied together by shared infrastructure, tooling, or objective. Analysts cluster individual incidents into a campaign once the connections are clear.
Kill Chain
A model breaking an intrusion into sequential stages, from reconnaissance through actions on objectives. Most commonly refers to the Lockheed Martin Cyber Kill Chain. Useful for thinking about where in an attack's lifecycle you actually have a chance to intervene.
Diamond Model
A way to describe any intrusion using four connected points: Adversary, Infrastructure, Capability, and Victim. See Where to Start for the full breakdown, or the MGM/Scattered Spider writeup on the blog for it applied to a real intrusion.
Pyramid of Pain
A model ranking indicators by how much it actually hurts an adversary when you take them away, from easy-to-change file hashes at the bottom up to their TTPs at the top. See Where to Start for the full breakdown.
TTP (Tactics, Techniques, and Procedures)
How an adversary operates, at three levels of specificity: Tactics are the why (e.g. gain initial access), Techniques are the how (e.g. phishing), and Procedures are the exact steps a specific actor takes. TTPs are the hardest thing for an attacker to change. See the Pyramid of Pain on Where to Start.
IOC (Indicator of Compromise)
Forensic evidence that something bad happened or is happening: a malicious file hash, IP address, domain, or URL. IOCs are easy for an attacker to change, so they're useful for detection but not very durable.
IOA (Indicator of Attack)
Similar to an IOC, but focused on behavior and intent rather than a static artifact, e.g. "this process is trying to dump credentials" rather than "this specific file hash is bad." IOAs tend to catch attacks earlier and survive an attacker changing their tools.
C2 (Command and Control)
The infrastructure and channel an attacker uses to communicate with and control compromised systems after initial access. Spotting C2 traffic is often how an intrusion gets discovered in the first place.
Attribution
The process (and the resulting judgment) of determining who is responsible for an attack. Really hard, and usually stated with a confidence level (low, moderate, high) rather than certainty.
TLP (Traffic Light Protocol)
A simple labeling system (Clear, Green, Amber, Amber+Strict, Red) for how widely a piece of intelligence can be shared. TLP:RED means don't share it beyond the room it was given in; TLP:CLEAR means share freely.
Indicator
A general term for any observable that might signal malicious activity, covering both IOCs and IOAs, and more.
Pivoting
Using one piece of information to find related pieces, e.g. taking a malicious domain and finding every other domain using the same TLS certificate or name servers. Pivoting is how isolated incidents get connected into a bigger picture.
Enrichment
Adding context to a raw indicator: where is this IP located, who owns this domain, has this hash been seen before, is it linked to a known threat actor. Enrichment turns "here's a hash" into "here's a hash, and here's what it means."
TIP (Threat Intelligence Platform)
Software built to collect, correlate, and manage threat data at scale: the analyst's central workspace for indicators, reports, and relationships. See the Tools page for real examples.
MISP
The Malware Information Sharing Platform, the most widely used open-source TIP in the field. Common enough as a term that people say "a MISP instance" the way they'd say "a Slack channel." See the Tools page for more.
STIX / TAXII
STIX (Structured Threat Information Expression) is a standard format for describing threat intelligence so it's readable across different tools. TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol used to actually move STIX data between platforms.
Sandbox
An isolated environment where you can safely detonate a suspicious file or URL and watch what it actually does, without risking your real systems.
Passive DNS
A historical record of what domain names have resolved to what IP addresses over time. Useful for spotting infrastructure reuse an attacker might not realize connects two seemingly unrelated incidents.
OSINT (Open-Source Intelligence)
Intelligence gathered from publicly available sources: social media, news, forums, breach databases, even a company's own job postings. A huge amount of CTI work is OSINT.
Intelligence Requirement (IR)
A specific question or priority a stakeholder needs answered, the thing that actually determines what an analyst collects and reports on. Good CTI programs are built around clearly defined IRs, not just "whatever seemed interesting this week."
PIR (Priority Intelligence Requirement)
The handful of intelligence requirements that matter most to leadership right now, e.g. "Which ransomware groups are going after our sector?" PIRs are what you check your work against when you're deciding whether a rabbit hole is worth it.
Estimative Language
Standard words for how likely something is (almost no chance, unlikely, roughly even chance, likely, almost certainly, etc.), so "likely" means the same thing every time you say it. The US intel community's version is in ICD 203, and we'll dig into it later in the CTI portfolio series on the blog.
Confidence Level
How solid your evidence is behind a judgment: low, moderate, or high. It's separate from likelihood! You can say something is likely with only low confidence if you're working from one shaky source.
Activity Cluster
A group of related activity that analysts haven't tied to a named actor yet. Vendors give these temporary names (Mandiant's UNC numbers, Microsoft's Storm-#### names) and later merge them into a named group, or don't, once there's enough evidence.
Want frameworks, a self-check, and a hands-on exercise too? Where to Start has all of it.
Go to Where to Start →