What it means
Threat infrastructure analysis connects domains, addresses, certificates, hosting, services, accounts, and timing to understand how an adversary supports operations.
Why it matters
Infrastructure relationships can reveal campaign scope and defensive opportunities, but shared services create significant attribution risk.
Practical focus
- Use multiple independent pivots
- Preserve temporal relationships
- Separate infrastructure ownership from adversary use
- Translate findings into detections and blocking decisions
Common mistakes
- Equating co-hosting with common control
- Ignoring legitimate compromise and rented infrastructure
- Publishing unvalidated indicators
- Failing to expire stale infrastructure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: