Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Analytic techniqueAdvanced

Threat Intelligence Link Analysis

Link analysis represents entities and relationships so analysts can examine clusters, central nodes, paths, shared attributes, and evidence gaps.

What it means

Link analysis represents entities and relationships so analysts can examine clusters, central nodes, paths, shared attributes, and evidence gaps.

Why it matters

Visual relationships can reveal useful patterns, but a graph is only as reliable as the underlying evidence and relationship definitions.

Practical focus

  • Define entity and relationship types
  • Attach source, time, and confidence to each link
  • Distinguish observed from inferred relationships
  • Use the graph to generate testable questions

Common mistakes

  • Treating visual proximity as proof
  • Mixing relationships with different meanings
  • Hiding uncertain or conflicting links
  • Building a graph too dense to support decisions

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

GIAC GCTICompTIA CySA+EC-Council CCISOISC2 CISSP

Authoritative sources