Chapter 13: Threat Intelligence Metrics, Indicators of Compromise, and the Pyramid of Pain
When executing a threat intelligence program, it is essential to have a set of criteria to determine its contribution to the overall system security and business. It means that the Cyber Threat Intelligence (CTI) analysts or team must select security intelligence metrics that will justify the program's existence, be it on the strategic, operational, or tactical level.
As CTI analysts, we always look for pieces of threat or breach evidence in the system to analyze security exposure and adversaries' activities. And those pieces of evidence are what make threat intelligence actionable. They are known as Indicators of Compromise (IOCs). Adversaries use many IOCs, and how we, analysts, respond to them will determine the level of pain it will cause those adversaries to reach their malicious objectives. This chapter focuses on security metrics for intelligence evaluation and the measurement...
