Glossary
The terms this whole field runs on, in plain language. Useful whether you're brand new or just need a quick refresher.
Threat Actor
An individual or group responsible for an attack or campaign, which could be a criminal group, a nation-state, a hacktivist, or an insider. It's a deliberately broad term, used when attribution isn't fully known or doesn't need to be specified.
APT (Advanced Persistent Threat)
A threat actor, usually nation-state-linked, who gets into a network and stays, quietly, for a long time to achieve a specific goal (espionage, sabotage) rather than a quick smash-and-grab. Often given a tracking name or number (e.g. APT34) by whoever first identified them.
Campaign
A set of related attacks or activity, usually against multiple targets, tied together by shared infrastructure, tooling, or objective. Analysts cluster individual incidents into a campaign once the connections are clear.
Kill Chain
A model breaking an intrusion into sequential stages, from reconnaissance through actions on objectives. Most commonly refers to the Lockheed Martin Cyber Kill Chain. Useful for thinking about where in an attack's lifecycle you actually have a chance to intervene.
Diamond Model
A way to describe any intrusion using four connected points: Adversary, Infrastructure, Capability, and Victim. See Where to Start for the full breakdown, or the MGM/Scattered Spider writeup on the blog for it applied to a real intrusion.
Pyramid of Pain
A model ranking indicators by how much it actually hurts an adversary when you take them away, from easy-to-change file hashes at the bottom up to their TTPs at the top. See Where to Start for the full breakdown.
TTP (Tactics, Techniques, and Procedures)
How an adversary operates, at three levels of specificity: Tactics are the why (e.g. gain initial access), Techniques are the how (e.g. phishing), and Procedures are the exact steps a specific actor takes. TTPs are the hardest thing for an attacker to change. See the Pyramid of Pain on Where to Start.
IOC (Indicator of Compromise)
Forensic evidence that something bad happened or is happening: a malicious file hash, IP address, domain, or URL. IOCs are easy for an attacker to change, so they're useful for detection but not very durable.
IOA (Indicator of Attack)
Similar to an IOC, but focused on behavior and intent rather than a static artifact, e.g. "this process is trying to dump credentials" rather than "this specific file hash is bad." IOAs tend to catch attacks earlier and survive an attacker changing their tools.
C2 (Command and Control)
The infrastructure and channel an attacker uses to communicate with and control compromised systems after initial access. Spotting C2 traffic is often how an intrusion gets discovered in the first place.
Attribution
The process (and the resulting judgment) of determining who is responsible for an attack. Genuinely hard, and usually stated with a confidence level (low, moderate, high) rather than certainty.
TLP (Traffic Light Protocol)
A simple labeling system (Clear, Green, Amber, Amber+Strict, Red) for how widely a piece of intelligence can be shared. TLP:RED means don't share it beyond the room it was given in; TLP:CLEAR means share freely.
Indicator
A general term for any observable that might signal malicious activity, covering both IOCs and IOAs, and more.
Pivoting
Using one piece of information to find related pieces, e.g. taking a malicious domain and finding every other domain registered with the same email address. Pivoting is how isolated incidents get connected into a bigger picture.
Enrichment
Adding context to a raw indicator: where is this IP located, who owns this domain, has this hash been seen before, is it linked to a known threat actor. Enrichment turns "here's a hash" into "here's a hash, and here's what it means."
TIP (Threat Intelligence Platform)
Software built to collect, correlate, and manage threat data at scale: the analyst's central workspace for indicators, reports, and relationships. See the Tools page for real examples.
MISP
The Malware Information Sharing Platform, the most widely used open-source TIP in the field. Common enough as a term that people say "a MISP instance" the way they'd say "a Slack channel." See the Tools page for more.
STIX / TAXII
STIX (Structured Threat Information Expression) is a standard format for describing threat intelligence so it's readable across different tools. TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol used to actually move STIX data between platforms.
Sandbox
An isolated environment where you can safely detonate a suspicious file or URL and watch what it actually does, without risking your real systems.
Passive DNS
A historical record of what domain names have resolved to what IP addresses over time. Useful for spotting infrastructure reuse an attacker might not realize connects two seemingly unrelated incidents.
OSINT (Open-Source Intelligence)
Intelligence gathered from publicly available sources: social media, news, forums, breach databases, even a company's own job postings. A huge amount of CTI work is OSINT.
Intelligence Requirement (IR)
A specific question or priority a stakeholder needs answered, the thing that actually determines what an analyst collects and reports on. Good CTI programs are built around clearly defined IRs, not just "whatever seemed interesting this week."
Want frameworks, a self-check, and a hands-on exercise too? Where to Start has all of it.
Go to Where to Start →