Which term describes threat intelligence that provides information about the resources an attacker uses to perform an attack, such as command and control channels and tools?

Which term describes threat intelligence that provides information about the resources an attacker uses to perform an attack, such as command and control channels and tools?

• A. Technical Threat Intelligence
• B. Incident Handling and Response
• C. Operational Threat Intelligence
• D. Eradication Phase

Answer: (D)

Threat intelligence that describes the attacker’s resources—how they communicate, where they operate, and what tools they use—helps defenders understand how campaigns are carried out and how to disrupt them. This kind of information is known as operational threat intelligence. It sits at a practical, campaign-level view, detailing attacker infrastructure, tools, and methods to enable proactive defense and response. Technical threat intelligence, by contrast, focuses on observable artifacts that can be detected or blocked, such as hashes, domains, or IP addresses. Incident handling and response covers the process of managing an incident, while the eradication phase is about removing the attacker’s artifacts and restoring systems.

Threat intelligence that describes the attacker’s resources—how they communicate, where they operate, and what tools they use—helps defenders understand how campaigns are carried out and how to disrupt them. This kind of information is known as operational threat intelligence. It sits at a practical, campaign-level view, detailing attacker infrastructure, tools, and methods to enable proactive defense and response.

Technical threat intelligence, by contrast, focuses on observable artifacts that can be detected or blocked, such as hashes, domains, or IP addresses. Incident handling and response covers the process of managing an incident, while the eradication phase is about removing the attacker’s artifacts and restoring systems.