Develop evidence-based threat intelligence and hunting hypotheses

Threat intelligence should record source, observation time, confidence, scope, and handling constraints. An indicator can age quickly: shared hosting changes, certificates rotate, and domains are repurposed. Validate that an indicator is relevant to the environment and decide whether it supports alerting, hunting, blocking, or context only.

STIX represents threat objects and relationships; TAXII can exchange collections. Structured format improves transport but does not make a claim trustworthy. Preserve producer confidence and markings, then apply local validation and expiration rather than turning every feed item into a permanent deny rule.

A hunt starts with a hypothesis that names a behavior, population, time window, and evidence capable of supporting or rejecting it. 'Look for bad things' cannot be falsified. ATT&CK can help describe behavior, but the hunt must translate a technique into local data components and expected records.

Document collection coverage before interpreting zero results. If command-line logging began yesterday, a thirty-day hunt cannot claim absence. Track query version, data sources, exclusions, and findings so another analyst can reproduce the result and convert useful logic into a monitored detection.

APT and insider are hypotheses about capability, access, intent, and persistence. Common tools and techniques are reused, so ATT&CK mappings or a heat map do not identify an actor. The Pyramid of Pain suggests that behavior-based detections are often costlier for an adversary to change than hashes or addresses, but operational cost and false positives still matter.

Confidence is not a permanent property. Ask when the intelligence was collected, whether it applies to this environment, and how accurate the producer has been for similar claims. OSINT is publicly obtainable; closed sources have access restrictions; sharing communities impose markings and handling rules that must follow the data.

The Pyramid of Pain ranks indicator types by how much it costs an adversary when defenders deny them. From bottom to top: hash values (trivial to change), IP addresses (easy), domain names (simple), network and host artifacts (annoying), tools (challenging), and TTPs (tough). A threat heat map colors a matrix, commonly the ATT&CK techniques, by how often each is sighted or how well it is detected, so concentrations and coverage gaps stand out.

Atomic indicators such as a hash or address are easy to match and often easy to change. Behavioral indicators describe a sequence or relationship and may be more durable, but require more context. Every indicator needs source, collection time, confidence, scope, deployment owner, performance review, and retirement conditions.

STRIDE prompts design review questions; it does not prove a threat exists or provide likelihood. Threat mapping connects assets, trust boundaries, actors, behaviors, and controls. Deception adds monitored artifacts such as canary credentials or decoy shares; it must avoid collecting unrelated user data or automatically taking high-impact action from one touch.