What it means
Campaign analysis groups related activity across time, targets, infrastructure, malware, techniques, and objectives to understand an adversary operation as a coherent whole.
Why it matters
Campaign context helps defenders anticipate likely next actions and avoid treating each alert as an isolated event.
Practical focus
- Define the evidence required to group activity
- Build a time-bounded campaign timeline
- Track changes in tools and infrastructure
- Separate observed behavior from attribution claims
Common mistakes
- Creating a campaign from one shared indicator
- Keeping a campaign open indefinitely
- Ignoring changes that contradict the cluster
- Assuming one campaign maps to one actor
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: