Cyber Wiki Topic 08

Security Operations & Incident Response

Monitoring, detection, investigation, response, recovery, forensics, and operational learning.

Topic Directory

267 entries

2015 Ukraine Electric Power Attack (C0028)

A defensive guide to the Enterprise ATT&CK campaign record C0028, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2015 campaign that disrupted Ukrainian electric-power substations using BlackEnergy and KillDisk.

ATT&CK Campaign Analysis · Intermediate

2016 Ukraine Electric Power Attack (C0025)

A defensive guide to the Enterprise ATT&CK campaign record C0025, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2016 campaign that disrupted Ukrainian electric-power distribution using Industroyer.

ATT&CK Campaign Analysis · Intermediate

2022 Ukraine Electric Power Attack (C0034)

A defensive guide to the Enterprise ATT&CK campaign record C0034, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2022 campaign against a Ukrainian electric utility that combined malware and living-off-the-land behavior to issue unauthorized SCADA commands.

ATT&CK Campaign Analysis · Intermediate

2025 Poland Wiper Attacks (C0063)

A defensive guide to the Enterprise ATT&CK campaign record C0063, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing destructive December 2025 attacks against Polish energy infrastructure involving Windows and PowerShell wipers.

ATT&CK Campaign Analysis · Intermediate

3CX Supply Chain Attack (C0057)

A defensive guide to the Enterprise ATT&CK campaign record C0057, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a cascading supply-chain compromise that moved from a trojanized trading application into 3CX build environments.

AI controls · Advanced

AI Control Monitoring

AI control monitoring observes whether preventive, detective, and corrective controls remain active, correctly configured, sufficiently covered, and effective as systems change.

AI resilience · Advanced

AI Deactivation and Contingency Controls

AI deactivation and contingency controls let an organization pause, limit, localize, roll back, or replace an AI capability when risk exceeds tolerance.

AI assurance · Advanced

AI Evidence Chain of Custody

AI evidence chain of custody records who collected, transferred, accessed, transformed, stored, and analyzed evidence from an AI system or incident.

AI incident response · Advanced

AI Incident Notification Governance

AI incident notification governance defines when, how, and by whom AI-related events are escalated to leaders, customers, regulators, vendors, legal counsel, and affected parties.

AI operational resilience · Advanced

AI Operational Readiness Review

An AI operational readiness review verifies that ownership, support, monitoring, incident response, continuity, capacity, user guidance, and rollback are ready before production use.

AI operations governance · Intermediate

AI Post-Deployment Monitoring

AI post-deployment monitoring measures whether a released system continues to perform, comply, and behave safely in its actual environment.

AI abuse prevention · Intermediate

AI Resource Abuse and Denial of Wallet

AI resource abuse targets compute, tokens, storage, tool calls, or paid services to exhaust capacity or create excessive cost.

AI operational resilience · Advanced

AI Rollback Readiness

AI rollback readiness is the proven ability to return to a known acceptable model, configuration, data pipeline, or operating mode after a harmful change.

AI incident response · Advanced

AI System Incident Response

AI-system incident response adapts preparation, detection, analysis, containment, recovery, and learning to failures and attacks involving models, data, prompts, outputs, pipelines, and automated decisions.

ATT&CK Campaign Analysis · Intermediate

APT28 Nearest Neighbor Campaign (C0051)

A defensive guide to the Enterprise ATT&CK campaign record C0051, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing APT28 activity from 2022 through 2024 that used nearby compromised networks and Wi-Fi paths to reach intended targets.

ATT&CK Campaign Analysis · Intermediate

APT41 DUST (C0040)

A defensive guide to the Enterprise ATT&CK campaign record C0040, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing APT41 information-gathering activity from 2023 through July 2024 against organizations in Europe, Asia, and the Middle East.

Defensive operations concept · Advanced

Active Defense

Active defense uses authorized, bounded techniques that increase visibility, constrain adversary freedom, and create response opportunities without abandoning legal, safety, or governance controls.

Validation practice · Advanced

Adversary Emulation for SOC Validation

Adversary emulation for SOC validation reproduces selected threat behaviors under controlled conditions to test people, telemetry, analytics, workflows, and decision authority end to end.

NIST CSF Category profile · Intermediate

Adverse Event Analysis (DE.AE) — NIST CSF 2.0 Category

Use DE.AE to manage analysis, correlation, context, impact, scope, information delivery, and incident declaration within the Detect Function.

Detection engineering · Advanced

Alert Actionability Engineering

Alert actionability engineering designs alerts so a responder can understand the condition, impact, evidence, urgency, owner, and next safe step.

Triage practice · Intermediate

Alert Classification and Routing

Alert classification and routing apply consistent categories, ownership rules, urgency, evidence requirements, and destination workflows so alerts reach the right responder quickly.

Detection engineering practice · Intermediate

Alert Engineering

Alert engineering turns observable behavior and use cases into actionable detection logic with defined context, thresholds, evidence, owner, response path, and validation test.

Triage practice · Intermediate

Alert Prioritization

Alert prioritization combines severity, confidence, asset importance, user context, exposure, active threat evidence, and potential business impact to order analyst attention.

Operations management practice · Intermediate

Alert Response Capacity Management

Alert response capacity management balances incoming alert demand, analyst skill, queue health, service expectations, automation, and surge plans to keep response sustainable.

Security operations · Foundational

Alert Triage

Alert triage is the rapid, evidence-based process of validating a security alert, estimating urgency and impact, and deciding the correct next action.

NIST CSF Subcategory profile · Intermediate

Analyze Potentially Adverse Events (DE.AE-02) — NIST CSF 2.0 Subcategory

Apply DE.AE-02 to achieve this CSF 2.0 outcome: Potentially adverse events are analyzed to better understand associated activities.

ATT&CK Campaign Analysis · Intermediate

Anthropic AI-orchestrated Campaign (C0062)

A defensive guide to the Enterprise ATT&CK campaign record C0062, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a September 2025 campaign in which a likely China-nexus actor manipulated Claude Code agents and MCP tools to automate portions of intrusions.

Security operations practice · Intermediate

Antivirus, EDR, and XDR

Antivirus, EDR, and XDR is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

NIST CSF Subcategory profile · Intermediate

Apply Recovery Initiation Criteria (RS.MA-05) — NIST CSF 2.0 Subcategory

Apply RS.MA-05 to achieve this CSF 2.0 outcome: The criteria for initiating incident recovery are applied.

ATT&CK Campaign Analysis · Intermediate

ArcaneDoor (C0046)

A defensive guide to the Enterprise ATT&CK campaign record C0046, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2023–2024 campaign against networking devices in government and critical-infrastructure environments.

Incident governance practice · Advanced

Attacker Communications Governance

Attacker communications governance defines who may communicate with an adversary, under what authority, through which channels, and with what legal, safety, and evidence controls.

Logging governance practice · Intermediate

Audit Log Retention and Integrity

Audit log retention and integrity controls preserve security-relevant records for operational analysis, investigations, accountability, compliance, and legal needs.

Architecture practice · Advanced

Audit Logging Architecture

Audit logging architecture defines which events are produced, transported, normalized, protected, retained, correlated, analyzed, and made available for investigations and accountability.

Security operations automation · Advanced

Automated Remediation Guardrails

Automated remediation guardrails constrain corrective actions by confidence, impact, scope, authorization, reversibility, and evidence quality.

Automation resilience · Advanced

Automation Rollback Safeguards

Automation rollback safeguards prepare tested methods to reverse or contain changes when automated deployment, configuration, or remediation produces unacceptable results.

Incident learning · Intermediate

Blameless Root-Cause Analysis

Blameless root-cause analysis examines technical and organizational conditions that made an incident possible without substituting individual blame for system improvement.

Resilience discipline · Intermediate

Business Continuity and Recovery

Business continuity and recovery prepare an organization to maintain essential functions, operate through disruption, and restore dependable services at an acceptable level.

ATT&CK Campaign Analysis · Intermediate

C0010 (C0010)

A defensive guide to the Enterprise ATT&CK campaign record C0010, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed cyber-espionage campaign reported against Israeli shipping, government, aviation, energy, and healthcare organizations.

ATT&CK Campaign Analysis · Intermediate

C0011 (C0011)

A defensive guide to the Enterprise ATT&CK campaign record C0011, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed suspected espionage campaign reported against university and college students in India.

ATT&CK Campaign Analysis · Intermediate

C0015 (C0015)

A defensive guide to the Enterprise ATT&CK campaign record C0015, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed five-day ransomware intrusion involving Bazar, Cobalt Strike, Conti, and other tools.

ATT&CK Campaign Analysis · Intermediate

C0017 (C0017)

A defensive guide to the Enterprise ATT&CK campaign record C0017, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed APT41 campaign that compromised multiple United States state-government networks in 2021–2022.

ATT&CK Campaign Analysis · Intermediate

C0018 (C0018)

A defensive guide to the Enterprise ATT&CK campaign record C0018, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed month-long intrusion that culminated in AvosLocker ransomware deployment.

ATT&CK Campaign Analysis · Intermediate

C0021 (C0021)

A defensive guide to the Enterprise ATT&CK campaign record C0021, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed November 2018 spearphishing campaign against public, nonprofit, educational, and private-sector organizations.

ATT&CK Campaign Analysis · Intermediate

C0026 (C0026)

A defensive guide to the Enterprise ATT&CK campaign record C0026, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed 2022 campaign that selectively delivered malware to prior ANDROMEDA victims in Ukraine.

ATT&CK Campaign Analysis · Intermediate

C0027 (C0027)

A defensive guide to the Enterprise ATT&CK campaign record C0027, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed financially motivated 2022 campaign linked to Scattered Spider and focused on telecommunications and business-process outsourcing companies.

ATT&CK Campaign Analysis · Intermediate

C0032 (C0032)

A defensive guide to the Enterprise ATT&CK campaign record C0032, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed 2019 campaign associated in public reporting with the Triton adversaries and focused on footholds in IT environments.

ATT&CK Campaign Analysis · Intermediate

C0033 (C0033)

A defensive guide to the Enterprise ATT&CK campaign record C0033, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed PROMETHIUM campaign that used StrongPity against Android users.

NIST CSF Subcategory profile · Intermediate

Categorize and Prioritize Incidents (RS.MA-03) — NIST CSF 2.0 Subcategory

Apply RS.MA-03 to achieve this CSF 2.0 outcome: Incidents are categorized and prioritized.

Financial monitoring · Intermediate

Cloud Cost Anomaly Detection

Cloud cost anomaly detection identifies unexpected changes in spend or usage that may indicate waste, configuration errors, abuse, compromise, or legitimate demand changes.

Forensic practice · Advanced

Cloud Forensics

Cloud forensics collects and analyzes provider logs, snapshots, object versions, identity records, network evidence, and service metadata for investigation.

Response practice · Advanced

Cloud Incident Response

Cloud incident response adapts preparation, detection, containment, eradication, and recovery to provider APIs, elastic resources, managed services, and shared responsibility.

Investigation practice · Advanced

Cloud Logging and Forensic Readiness

Cloud forensic readiness ensures that logs, snapshots, metadata, identities, timestamps, and response procedures are available before an incident requires them.

Network telemetry · Intermediate

Cloud Network Flow Logs

Cloud network flow logs record summarized connection metadata from virtual networks, interfaces, gateways, and security controls for monitoring, troubleshooting, and investigation.

Operational practice · Intermediate

Cloud Observability

Cloud observability uses logs, metrics, traces, events, and context to understand system behavior and investigate unexpected conditions.

Operating principle · Intermediate

Cloud Operational Excellence

Cloud operational excellence uses automation, observability, controlled change, learning, and repeatable procedures to operate workloads safely at scale.

Cloud detection practice · Advanced

Cloud Storage Exfiltration Detection

Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.

Security capability · Advanced

Cloud Workload Protection

Cloud workload protection applies preventive and detective controls to virtual machines, containers, serverless functions, and managed compute environments.

Detection practice · Intermediate

Command and Control Detection

Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.

NIST CSF Subcategory profile · Intermediate

Communicate Recovery Progress (RC.CO-03) — NIST CSF 2.0 Subcategory

Apply RC.CO-03 to achieve this CSF 2.0 outcome: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.

Detection content practice · Intermediate

Community-Sourced Detection Content

Community-sourced detection content includes shared rules, signatures, queries, mappings, and playbooks that can accelerate coverage when teams validate and adapt them to local data and risk.

NIST CSF Subcategory profile · Intermediate

Contain Incidents (RS.MI-01) — NIST CSF 2.0 Subcategory

Apply RS.MI-01 to achieve this CSF 2.0 outcome: Incidents are contained.

NIST CSF Category profile · Intermediate

Continuous Monitoring (DE.CM) — NIST CSF 2.0 Category

Use DE.CM to manage monitoring networks, facilities, personnel activity, external services, platforms, and runtime environments within the Detect Function.

Recovery practice · Intermediate

Controlled System Reentry

Controlled system reentry restores cleaned or rebuilt assets to production in stages, with validation, monitoring, rollback criteria, and explicit acceptance of remaining risk.

NIST CSF Subcategory profile · Intermediate

Correlate Information from Multiple Sources (DE.AE-03) — NIST CSF 2.0 Subcategory

Apply DE.AE-03 to achieve this CSF 2.0 outcome: Information is correlated from multiple sources.

ATT&CK Campaign Analysis · Intermediate

CostaRicto (C0004)

A defensive guide to the Enterprise ATT&CK campaign record C0004, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a suspected hacker-for-hire espionage campaign reported across multiple industries and regions.

Scenario response practice · Intermediate

Credential Attack Incident Response

Credential attack incident response addresses password spraying, stuffing, brute force, phishing, token theft, session hijacking, and unauthorized account use.

ATT&CK Campaign Analysis · Intermediate

Cutting Edge (C0029)

A defensive guide to the Enterprise ATT&CK campaign record C0029, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a China-nexus espionage campaign that exploited Ivanti Connect Secure zero-day vulnerabilities beginning in late 2023.

Crisis-management practice · Advanced

Cyber Crisis Communications

Cyber crisis communications coordinates timely, accurate, authorized messages for employees, customers, partners, regulators, media, and other stakeholders.

Preparedness practice · Intermediate

Cyber Incident Exercises

Cyber incident exercises use discussion or simulated operations to test plans, decisions, coordination, communications, and recovery under realistic conditions.

Response documentation practice · Intermediate

Cyber Incident Reporting

Cyber incident reporting documents what occurred, impact, scope, actions, evidence, decisions, recovery status, and remaining risk for the intended audience.

Learning practice · Intermediate

Cybersecurity After-Action Review

A cybersecurity after-action review compares intended and actual response, identifies strengths and gaps, and converts lessons into owned improvements.

Detection practice · Intermediate

Data Exfiltration Detection

Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.

Data operations · Intermediate

Data Quality Monitoring

Data quality monitoring continuously evaluates whether incoming and stored data meet defined expectations for structure, completeness, validity, freshness, consistency, and distribution.

Detection engineering · Advanced

Database Activity Monitoring

Database activity monitoring analyzes database sessions and commands to identify suspicious access, policy violations, misuse, and operational anomalies.

Database monitoring · Intermediate

Database Audit Logging

Database audit logging records security-relevant access, administrative changes, authentication events, and sensitive data operations with enough context for investigation and assurance.

NIST CSF Subcategory profile · Intermediate

Declare Incidents Using Defined Criteria (DE.AE-08) — NIST CSF 2.0 Subcategory

Apply DE.AE-08 to achieve this CSF 2.0 outcome: Incidents are declared when adverse events meet the defined incident criteria.

NIST CSF Subcategory profile · Intermediate

Declare the End of Recovery (RC.RP-06) — NIST CSF 2.0 Subcategory

Apply RC.RP-06 to achieve this CSF 2.0 outcome: The end of incident recovery is declared based on criteria, and incident-related documentation is completed.

NIST CSF Function profile · Foundational

Detect (DE) — NIST CSF 2.0 Function

Use the Detect Function to monitor environments and analyze events so potentially adverse activity is discovered, correlated, understood, and escalated.

Detection-program assessment · Advanced

Detection Coverage and Gap Analysis

Detection coverage and gap analysis determines which priority adversary behaviors, misuse cases, control failures, and business risks are observable and actionable, and where missing telemetry, analytic logic, context, or response capacity leaves a gap.

Detection engineering practice · Intermediate

Detection Data-Source Requirements

Detection data-source requirements specify the events, fields, timestamps, identity context, retention, quality, and availability an analytic or investigation needs.

Detection engineering practice · Intermediate

Detection Tuning Feedback Loops

Detection tuning feedback loops use analyst dispositions, missed detections, environmental change, testing, and workload evidence to improve analytic precision without erasing useful coverage.

Detection engineering · Advanced

Detection Use-Case Acceptance Criteria

Detection use-case acceptance criteria define the threat behavior, data, logic, context, expected alert, performance, ownership, response path, and evidence required before a detection is treated as operational.

Detection engineering practice · Intermediate

Detection Use-Case Engineering

Detection use-case engineering converts priority threats and business exposure into defined data needs, analytic logic, triage steps, expected evidence, and validation criteria.

Assurance practice · Intermediate

Detection Validation and Testing

Detection validation and testing confirms that analytics receive required data, trigger on expected behavior, generate useful evidence, route correctly, and continue working after environmental change.

Detection engineering practice · Advanced

Detection as Code

Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.

Investigative discipline · Intermediate

Digital Forensics

Digital forensics applies repeatable methods to identify, preserve, collect, examine, analyze, and communicate evidence from digital systems and services.

Digital forensics discipline · Advanced

Disk Forensics

Disk forensics acquires and examines storage media and file-system artifacts to reconstruct user, application, operating-system, and adversary activity while preserving evidence integrity and provenance.

Scenario response practice · Intermediate

Email Attack Incident Response

Email attack incident response addresses phishing, business email compromise, malicious attachments, impersonation, mailbox abuse, and related identity compromise.

Endpoint monitoring concept · Advanced

Endpoint Detection and Response Telemetry

EDR telemetry records endpoint behavior such as process execution, modules, files, registry, users, network connections, scripts, drivers, security events, and response actions so analysts can detect and investigate activity in context.

NIST CSF Subcategory profile · Intermediate

Eradicate Incidents (RS.MI-02) — NIST CSF 2.0 Subcategory

Apply RS.MI-02 to achieve this CSF 2.0 outcome: Incidents are eradicated.

NIST CSF Subcategory profile · Intermediate

Escalate or Elevate Incidents (RS.MA-04) — NIST CSF 2.0 Subcategory

Apply RS.MA-04 to achieve this CSF 2.0 outcome: Incidents are escalated or elevated as needed.

NIST CSF Subcategory profile · Intermediate

Establish Incident Facts and Root Cause (RS.AN-03) — NIST CSF 2.0 Subcategory

Apply RS.AN-03 to achieve this CSF 2.0 outcome: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.

NIST CSF Subcategory profile · Intermediate

Establish Post-Incident Operational Norms (RC.RP-04) — NIST CSF 2.0 Subcategory

Apply RC.RP-04 to achieve this CSF 2.0 outcome: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms.

NIST CSF Subcategory profile · Intermediate

Estimate and Validate Incident Magnitude (RS.AN-08) — NIST CSF 2.0 Subcategory

Apply RS.AN-08 to achieve this CSF 2.0 outcome: An incident’s magnitude is estimated and validated.

Investigative control · Intermediate

Evidence Handling and Chain of Custody

Evidence handling protects the integrity, identity, context, and accountability of information collected during an investigation or legal process.

NIST CSF Subcategory profile · Intermediate

Execute the Incident Response Plan (RS.MA-01) — NIST CSF 2.0 Subcategory

Apply RS.MA-01 to achieve this CSF 2.0 outcome: The incident response plan is executed in coordination with relevant third parties once an incident is declared.

NIST CSF Subcategory profile · Intermediate

Execute the Recovery Plan (RC.RP-01) — NIST CSF 2.0 Subcategory

Apply RC.RP-01 to achieve this CSF 2.0 outcome: The recovery portion of the incident response plan is executed once initiated from the incident response process.

Leadership communication practice · Advanced

Executive Incident Briefings

Executive incident briefings summarize current impact, confidence, decisions, risks, resource needs, and next milestones without overwhelming leaders with raw technical detail.

ATT&CK Campaign Analysis · Intermediate

FLORAHOX Activity (C0053)

A defensive guide to the Enterprise ATT&CK campaign record C0053, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity conducted through a hybrid operational-relay-box network combining compromised devices and leased virtual private servers.

Security operations practice · Intermediate

File Integrity Monitoring

File Integrity Monitoring is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Digital forensics method · Advanced

Forensic Timeline Analysis

Forensic timeline analysis orders and correlates events from systems, files, identities, networks, applications, and people to explain what happened, when it happened, how confidently it is known, and where evidence is missing or contradictory.

ATT&CK Campaign Analysis · Intermediate

Frankenstein (C0001)

A defensive guide to the Enterprise ATT&CK campaign record C0001, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a highly targeted 2019 campaign whose operators assembled multiple unrelated open-source components.

ATT&CK Campaign Analysis · Intermediate

FrostyGoop Incident (C0041)

A defensive guide to the Enterprise ATT&CK campaign record C0041, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a January 2024 incident against a Ukrainian municipal heating provider involving FrostyGoop and legitimate Modbus commands.

ATT&CK Campaign Analysis · Intermediate

FunnyDream (C0007)

A defensive guide to the Enterprise ATT&CK campaign record C0007, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a suspected Chinese espionage campaign reported against government and foreign organizations in Southeast Asia.

ATT&CK Campaign Analysis · Intermediate

HomeLand Justice (C0038)

A defensive guide to the Enterprise ATT&CK campaign record C0038, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a disruptive 2022 campaign by Iranian state-affiliated actors against Albanian government networks.

Continuous-improvement practice · Intermediate

Hunt-to-Detection Feedback

Hunt-to-detection feedback converts validated hunt findings into durable analytics, playbooks, telemetry requirements, asset improvements, and threat-intelligence questions.

Service management · Intermediate

IT Service Incident Management

IT service incident management restores normal service operation as quickly as practical while controlling impact, communication, escalation, evidence, and handoff to deeper analysis.

Service management · Intermediate

IT Service Problem Management

IT service problem management reduces the likelihood and impact of incidents by identifying causes, managing known errors and workarounds, and driving durable corrective action.

NIST CSF Category profile · Intermediate

Incident Analysis (RS.AN) — NIST CSF 2.0 Category

Use RS.AN to manage facts, root cause, evidence preservation, action records, and magnitude estimation within the Respond Function.

Investigation practice · Advanced

Incident Artifact Analysis

Incident artifact analysis examines files, memory, metadata, processes, network records, messages, and other evidence to extract indicators, behavior, provenance, and investigative leads.

Response governance practice · Intermediate

Incident Closure Criteria

Incident closure criteria define the evidence and approvals required before an event leaves active response and enters monitoring, remediation, or normal operations.

Incident management · Advanced

Incident Command Automation Boundaries

Incident command automation boundaries specify which coordination, communication, evidence, and technical actions may be automated and which require accountable human command.

Governance practice · Intermediate

Incident Decision Logging

Incident decision logging records significant choices, authority, time, evidence, assumptions, alternatives, and expected consequences.

Investigation practice · Intermediate

Incident Hypothesis Development

Incident hypothesis development frames testable explanations for observed activity, expected evidence, competing possibilities, and the next collection actions needed to reduce uncertainty.

NIST CSF Category profile · Intermediate

Incident Management (RS.MA) — NIST CSF 2.0 Category

Use RS.MA to manage plan execution, report validation, categorization, prioritization, escalation, and recovery initiation within the Respond Function.

Incident governance model · Intermediate

Incident Management Team

An incident management team brings together authorized leaders and specialists to direct technical response, business coordination, communications, legal decisions, and recovery.

NIST CSF Category profile · Intermediate

Incident Mitigation (RS.MI) — NIST CSF 2.0 Category

Use RS.MI to manage containment, eradication, risk tradeoffs, and preventing recurrence or spread within the Respond Function.

NIST CSF Category profile · Intermediate

Incident Recovery Communication (RC.CO) — NIST CSF 2.0 Category

Use RC.CO to manage recovery status, stakeholder expectations, public updates, and coordinated transition within the Recover Function.

NIST CSF Category profile · Intermediate

Incident Recovery Plan Execution (RC.RP) — NIST CSF 2.0 Category

Use RC.RP to manage plan execution, prioritization, restoration, verification, post-incident norms, and recovery closure within the Recover Function.

Recovery assurance practice · Advanced

Incident Recovery Validation

Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.

Workforce resilience practice · Advanced

Incident Responder Fatigue Management

Incident responder fatigue management uses staffing, shifts, handoffs, rest, psychological support, and workload controls to sustain sound decisions during extended events.

Operational lifecycle · Intermediate

Incident Response Lifecycle

Incident response is a coordinated capability that combines preparation, analysis, action, recovery, communication, evidence, and improvement.

Program measurement practice · Advanced

Incident Response Metrics

Incident response metrics evaluate readiness, detection, decision speed, containment, recovery, communication, recurrence, and improvement rather than counting tickets alone.

Response planning practice · Intermediate

Incident Response Objectives

Incident response objectives define the outcomes the team must achieve, such as stopping harm, protecting evidence, sustaining critical services, removing access, and restoring trusted operations.

Continuous-improvement practice · Advanced

Incident Response Process Improvement

Incident response process improvement uses incidents, exercises, metrics, audits, and near misses to reduce friction and increase future speed, quality, and resilience.

Preparedness practice · Intermediate

Incident Response Readiness

Incident response readiness ensures roles, authority, communications, tooling, access, evidence procedures, exercises, and dependencies are prepared before an incident begins.

NIST CSF Category profile · Intermediate

Incident Response Reporting and Communication (RS.CO) — NIST CSF 2.0 Category

Use RS.CO to manage stakeholder notification, coordination, information sharing, and obligation-aware communication within the Respond Function.

Workforce preparedness practice · Intermediate

Incident Response Training Program

An incident response training program develops role-specific knowledge, decision skills, tool proficiency, communication habits, and backup coverage for responders and stakeholders.

Post-incident analysis practice · Advanced

Incident Root-Cause Analysis

Incident root-cause analysis identifies the technical, process, organizational, and environmental conditions that allowed an incident to begin, spread, or remain undetected.

Triage practice · Intermediate

Incident Severity Classification

Incident severity classification assigns a consistent priority using factors such as mission impact, data sensitivity, scope, safety, legal obligations, adversary activity, and recovery difficulty.

Coordination practice · Intermediate

Incident Task Tracking

Incident task tracking records actions, owners, dependencies, deadlines, status, blockers, and completion evidence throughout a response.

Investigation practice · Advanced

Incident Timeline Reconstruction

Incident timeline reconstruction orders events, observations, actions, and decisions across systems and teams to explain what happened and when.

ATT&CK Campaign Analysis · Intermediate

Indian Critical Infrastructure Intrusions (C0043)

A defensive guide to the Enterprise ATT&CK campaign record C0043, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing PRC-linked intrusions during 2021–2022 against Indian electric-utility, logistics, and related IT environments.

NIST CSF Subcategory profile · Intermediate

Integrate Threat Intelligence and Context (DE.AE-07) — NIST CSF 2.0 Subcategory

Apply DE.AE-07 to achieve this CSF 2.0 outcome: Cyber threat intelligence and other contextual information are integrated into the analysis.

Hunting practice · Advanced

Intelligence-Led Threat Hunting

Intelligence-led threat hunting converts validated adversary knowledge into hypotheses, data requirements, analytic methods, and searches for activity that existing detections may miss.

ATT&CK Campaign Analysis · Intermediate

J-magic Campaign (C0050)

A defensive guide to the Enterprise ATT&CK campaign record C0050, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2023–2024 campaign that used a tailored J-magic backdoor against Juniper routers serving as VPN gateways.

ATT&CK Campaign Analysis · Intermediate

Juicy Mix (C0044)

A defensive guide to the Enterprise ATT&CK campaign record C0044, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2022 OilRig campaign that targeted Israeli organizations with the Mango backdoor.

ATT&CK Campaign Analysis · Intermediate

KV Botnet Activity (C0035)

A defensive guide to the Enterprise ATT&CK campaign record C0035, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity involving compromised end-of-life SOHO equipment used to obscure access to critical-infrastructure victims.

ATT&CK Campaign Analysis · Intermediate

Leviathan Australian Intrusions (C0049)

A defensive guide to the Enterprise ATT&CK campaign record C0049, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing long-term intrusions in Australia involving external-service exploitation, credential capture, lateral movement, and data theft.

Security telemetry · Intermediate

Linux Audit Framework

The Linux Audit Framework records security-relevant system calls, identity activity, object access, and policy events according to rules designed for investigation and accountability.

Analytical practice · Intermediate

Log Analysis

Log analysis interprets recorded events to answer questions about system behavior, user activity, failures, attacks, and the sequence of an incident.

Security data engineering concept · Advanced

Log Quality Engineering

Log quality engineering measures and improves whether security events are complete, accurate, timely, consistent, attributable, protected, and usable for the detections and investigations that depend on them.

Log governance · Intermediate

Log Rotation and Retention

Log rotation and retention balance evidence needs, storage limits, privacy, performance, legal obligations, and reliable archival so important events remain available for the required period.

Security operations process · Intermediate

Log Source Onboarding

Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.

Assurance method · Intermediate

MITRE ATT&CK® Coverage and Gap Analysis

How to measure coverage without equating a colored matrix cell with a validated detection or effective control.

Detection engineering method · Intermediate

MITRE ATT&CK® Detection Strategies, Analytics, and Data Components

How defenders move from required observations to analytic logic, testing, tuning, ownership, and response-ready evidence.

AI operations · Advanced

Machine-Learning Observability

Machine-learning observability combines system, data, model, and business evidence so teams can understand whether an AI service is healthy and trustworthy in operation.

Defensive assurance practice · Intermediate

Malware Defense Validation

Malware defense validation tests whether prevention, detection, isolation, and response controls work against relevant behaviors without exposing production systems to uncontrolled risk.

Malware analysis technique · Advanced

Malware Sandboxing

Malware sandboxing executes or emulates suspicious code in a controlled environment to observe processes, files, registry changes, network activity, persistence, evasion, and other behavior without exposing production systems.

Incident analysis method · Intermediate

Mapping Incidents to MITRE ATT&CK®

A disciplined method for mapping observed behavior to ATT&CK techniques, preserving evidence, confidence, scope, and the difference between an action and an inferred objective.

ATT&CK Campaign Analysis · Intermediate

Maroochy Water Breach (C0020)

A defensive guide to the Enterprise ATT&CK campaign record C0020, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2000 incident in which a wastewater control system was abused to disrupt operations and release sewage.

Resilience planning · Foundational

Maximum Tolerable Downtime

Maximum tolerable downtime is the longest disruption a business process can endure before consequences become unacceptable.

Operational measurement · Foundational

Mean Time Metrics

Mean time metrics summarize average durations for activities such as detection, acknowledgment, response, repair, recovery, or failure, but require precise definitions to be useful.

Security operations practice · Intermediate

Memory Forensics

Memory Forensics is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

NIST CSF Subcategory profile · Intermediate

Monitor Computing and Runtime Environments (DE.CM-09) — NIST CSF 2.0 Subcategory

Apply DE.CM-09 to achieve this CSF 2.0 outcome: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.

NIST CSF Subcategory profile · Intermediate

Monitor External Service Providers (DE.CM-06) — NIST CSF 2.0 Subcategory

Apply DE.CM-06 to achieve this CSF 2.0 outcome: External service provider activities and services are monitored to find potentially adverse events.

NIST CSF Subcategory profile · Intermediate

Monitor Networks and Network Services (DE.CM-01) — NIST CSF 2.0 Subcategory

Apply DE.CM-01 to achieve this CSF 2.0 outcome: Networks and network services are monitored to find potentially adverse events.

NIST CSF Subcategory profile · Intermediate

Monitor Personnel Activity and Technology Use (DE.CM-03) — NIST CSF 2.0 Subcategory

Apply DE.CM-03 to achieve this CSF 2.0 outcome: Personnel activity and technology usage are monitored to find potentially adverse events.

NIST CSF Subcategory profile · Intermediate

Monitor the Physical Environment (DE.CM-02) — NIST CSF 2.0 Subcategory

Apply DE.CM-02 to achieve this CSF 2.0 outcome: The physical environment is monitored to find potentially adverse events.

Detection capability · Intermediate

Network Detection and Response

Network detection and response uses traffic, flow, protocol, and metadata observations to identify suspicious behavior and support investigation across network boundaries.

Network monitoring concept · Advanced

Network Traffic Analysis

Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.

Security operations practice · Intermediate

Network Traffic Flow Records

Network Traffic Flow Records is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK Campaign Analysis · Intermediate

Night Dragon (C0002)

A defensive guide to the Enterprise ATT&CK campaign record C0002, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an espionage campaign reported against oil, energy, and petrochemical companies and related individuals.

NIST CSF Subcategory profile · Intermediate

Notify Stakeholders (RS.CO-02) — NIST CSF 2.0 Subcategory

Apply RS.CO-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are notified of incidents.

Operational technology incident response · Advanced

OT Incident Command Integration

OT incident command integration aligns cyber investigation and containment with operations, engineering, safety, emergency management, communications, legal, vendors, and business continuity.

Operational technology incident response · Advanced

OT Incident Exercises

OT incident exercises rehearse how people, systems, procedures, vendors, and physical operations respond to cyber events under realistic safety and continuity constraints.

Operational technology monitoring · Advanced

OT Log Collection Under Constraints

OT log collection under constraints prioritizes high-value security and operational evidence while respecting limited storage, bandwidth, device capability, vendor support, safety, and timing requirements.

Operational technology monitoring · Advanced

OT Network Monitoring Baselines

OT network monitoring baselines describe expected devices, peers, protocols, commands, direction, timing, volume, and maintenance behavior so meaningful deviations can be investigated.

Operational technology resilience · Advanced

OT Recovery and Process Safety

OT recovery restores trustworthy control, visibility, configuration, data, and operations in a sequence that protects people, environment, equipment, and process stability.

Operational technology security · Advanced

OT Vendor Access Monitoring

OT vendor access monitoring observes and evaluates external support sessions, commands, file transfers, configuration changes, tools, targets, and outcomes against approved work.

Observability engineering · Advanced

Observability Correlation Identifiers

Observability correlation identifiers connect related logs, traces, metrics, events, jobs, users, changes, and requests across distributed automation.

Assurance practice · Advanced

Observability Coverage Analysis

Observability coverage analysis compares priority assets, identities, behaviors, paths, and failure modes with actual sensors, logs, fields, retention, analytics, and response access.

ATT&CK Campaign Analysis · Intermediate

Operation AkaiRyū (C0060)

A defensive guide to the Enterprise ATT&CK campaign record C0060, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2024 MirrorFace spearphishing campaign against organizations in Japan and Central Europe.

ATT&CK Campaign Analysis · Intermediate

Operation CuckooBees (C0012)

A defensive guide to the Enterprise ATT&CK campaign record C0012, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a cyber-espionage campaign against technology and manufacturing companies reported since at least 2019.

ATT&CK Campaign Analysis · Intermediate

Operation Digital Eye (C0061)

A defensive guide to the Enterprise ATT&CK campaign record C0061, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2024 suspected PRC-nexus campaign against business-to-business IT service providers in Southern Europe.

ATT&CK Campaign Analysis · Intermediate

Operation Dream Job (C0022)

A defensive guide to the Enterprise ATT&CK campaign record C0022, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an espionage operation using employment-themed lures against defense, aerospace, government, and other sectors.

ATT&CK Campaign Analysis · Intermediate

Operation Dust Storm (C0016)

A defensive guide to the Enterprise ATT&CK campaign record C0016, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a long-running espionage campaign reported across industries in East Asia, Southeast Asia, Europe, and the United States.

ATT&CK Campaign Analysis · Intermediate

Operation Ghost (C0023)

A defensive guide to the Enterprise ATT&CK campaign record C0023, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an APT29 campaign beginning in 2013 against foreign ministries and a European embassy in Washington, D.C..

ATT&CK Campaign Analysis · Intermediate

Operation Honeybee (C0006)

A defensive guide to the Enterprise ATT&CK campaign record C0006, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2017–2018 campaign against humanitarian-aid and inter-Korean affairs organizations across several countries.

ATT&CK Campaign Analysis · Intermediate

Operation MidnightEclipse (C0048)

A defensive guide to the Enterprise ATT&CK campaign record C0048, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a March–April 2024 campaign that exploited a PAN-OS GlobalProtect zero-day vulnerability.

ATT&CK Campaign Analysis · Intermediate

Operation Sharpshooter (C0013)

A defensive guide to the Enterprise ATT&CK campaign record C0013, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a global espionage campaign reported against nuclear, defense, government, energy, and financial organizations.

ATT&CK Campaign Analysis · Intermediate

Operation Spalax (C0005)

A defensive guide to the Enterprise ATT&CK campaign record C0005, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign reported against Colombian government and private-sector organizations, especially energy and metallurgical entities.

ATT&CK Campaign Analysis · Intermediate

Operation Triangulation (C0054)

A defensive guide to the Enterprise ATT&CK campaign record C0054, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a mobile campaign that used zero-click iMessage exploit chains and the TriangleDB implant against iOS devices.

ATT&CK Campaign Analysis · Intermediate

Operation Wocao (C0014)

A defensive guide to the Enterprise ATT&CK campaign record C0014, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a global cyber-espionage campaign reported against governments, managed-service providers, and many industries.

ATT&CK mitigation profile · Intermediate

Out-of-Band Communications Channel (M1060)

Maintain a communications path independent of potentially compromised production identity, messaging, and network services. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

ATT&CK Campaign Analysis · Intermediate

Outer Space (C0042)

A defensive guide to the Enterprise ATT&CK campaign record C0042, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2021 OilRig campaign that targeted Israeli organizations using the SampleCheck5000 downloader and Solar backdoor.

Service management · Intermediate

PCI File Integrity Monitoring

PCI file integrity monitoring detects unauthorized changes to critical system files, configuration files, content, and other security-relevant objects and routes meaningful alerts for investigation.

Service management · Intermediate

PCI Incident Response Testing

PCI incident response testing exercises payment-data scenarios, roles, communications, containment, evidence, third-party coordination, legal obligations, recovery, and lessons before a real compromise.

Service management · Intermediate

PCI Time Synchronization

PCI time synchronization keeps security-relevant systems aligned to trusted time sources so logs, alerts, transactions, authentication events, and forensic evidence can be correlated accurately.

Operational technology security · Advanced

PLC Logic Change Monitoring

PLC logic change monitoring detects and verifies modifications to control logic, parameters, firmware, operating mode, and controller configuration against approved work.

Security operations practice · Intermediate

Packet Capture and PCAP Analysis

Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

ATT&CK Campaign Analysis · Intermediate

Pikabot Distribution February 2024 (C0036)

A defensive guide to the Enterprise ATT&CK campaign record C0036, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a February 2024 malicious-email campaign distributing a substantially revised Pikabot variant.

Security operations practice · Intermediate

PowerShell Security and Logging

PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

NIST CSF Subcategory profile · Intermediate

Preserve Incident Data and Metadata (RS.AN-07) — NIST CSF 2.0 Subcategory

Apply RS.AN-07 to achieve this CSF 2.0 outcome: Incident data and metadata are collected, and their integrity and provenance are preserved.

NIST CSF Subcategory profile · Intermediate

Preserve Investigation Action Records (RS.AN-06) — NIST CSF 2.0 Subcategory

Apply RS.AN-06 to achieve this CSF 2.0 outcome: Actions performed during an investigation are recorded, and the records’ integrity and provenance are preserved.

Privacy incident operations · Advanced

Privacy Breach Assessment Workflow

A privacy breach assessment workflow applies defined facts, legal tests, risk factors, and approval authority to decide whether an event requires notification or another response.

Privacy incident operations · Intermediate

Privacy Incident Register

A privacy incident register is the authoritative record of suspected and confirmed events, affected processing, decisions, notifications, remediation, and lessons learned.

Privacy engineering · Advanced

Privacy Runtime Monitoring

Privacy runtime monitoring detects when deployed processing diverges from approved purpose, data scope, access, destination, retention, consent, or user-choice expectations.

NIST CSF Subcategory profile · Intermediate

Provide Event Information to Authorized Staff and Tools (DE.AE-06) — NIST CSF 2.0 Subcategory

Apply DE.AE-06 to achieve this CSF 2.0 outcome: Information on adverse events is provided to authorized staff and tools.

ATT&CK Campaign Analysis · Intermediate

Quad7 Activity (C0055)

A defensive guide to the Enterprise ATT&CK campaign record C0055, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a botnet of compromised SOHO routers used as egress infrastructure by multiple China-affiliated threat actors.

Crisis communication practice · Advanced

Ransomware Communications

Ransomware communications coordinates internal updates, leadership decisions, legal and law-enforcement engagement, customer messaging, and any authorized adversary contact.

NIST CSF Function profile · Foundational

Recover (RC) — NIST CSF 2.0 Function

Use the Recover Function to restore assets and operations, verify their integrity, communicate progress, and transition the organization back to stable operations.

Recovery assurance practice · Intermediate

Recovery Testing and Restore Assurance

Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.

Resilience measure · Beginner

Recovery Time and Recovery Point Objectives

Recovery time objective describes the target time to restore an important function, while recovery point objective describes the acceptable amount of data loss measured in time.

ATT&CK Campaign Analysis · Intermediate

RedDelta Modified PlugX Infection Chain Operations (C0047)

A defensive guide to the Enterprise ATT&CK campaign record C0047, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing Mustang Panda phishing and PlugX activity against East and Southeast Asian entities from 2023 through 2024.

ATT&CK Campaign Analysis · Intermediate

RedPenguin (C0056)

A defensive guide to the Enterprise ATT&CK campaign record C0056, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing investigative tracking of custom TINYSHELL variants deployed on Juniper MX routers.

NIST CSF Function profile · Foundational

Respond (RS) — NIST CSF 2.0 Function

Use the Respond Function to manage, analyze, communicate, contain, and eradicate incidents using coordinated authority and tested procedures.

Security operations automation · Advanced

Runbook Automation Safeguards

Runbook automation safeguards convert operational procedures into controlled actions with validated preconditions, bounded permissions, approvals, logging, and clear handoff to people.

Detection-program process · Advanced

SIEM Use-Case Lifecycle

The SIEM use-case lifecycle manages a detection from threat and business requirement through data validation, analytic design, testing, deployment, triage, measurement, tuning, maintenance, and retirement.

Process-improvement practice · Intermediate

SOC Bottleneck Analysis

SOC bottleneck analysis identifies queues, dependencies, missing authority, skill constraints, tool friction, and data-quality problems that slow or degrade security decisions.

Operations practice · Intermediate

SOC Handoffs and Case Management

SOC handoffs and case management preserve context, evidence, ownership, priority, and decisions as work moves across shifts, tiers, teams, and response functions.

Operating model · Intermediate

SOC Mission and Scope

SOC mission and scope define which risks, services, systems, users, hours, and decisions the security operations capability is accountable for.

Operating model · Intermediate

SOC Operating Models

SOC operating models describe how in-house, outsourced, hybrid, distributed, and follow-the-sun teams divide monitoring, investigation, response, and accountability.

Analytics practice · Intermediate

SOC Operational Analytics

SOC operational analytics examines workload, outcomes, quality, coverage, recurrence, timing, and resource consumption to explain how the SOC is performing and where change will matter.

Measurement practice · Intermediate

SOC Performance Metrics

SOC performance metrics combine timeliness, detection quality, investigation accuracy, coverage, workload, recurrence, and business impact instead of rewarding raw ticket volume.

Risk model · Intermediate

SOC Risk Profile

A SOC risk profile translates business criticality, threat exposure, technology, regulatory obligations, and response constraints into operational priorities and escalation thresholds.

Operating model · Intermediate

SOC Service Catalog and Coverage Model

A SOC service catalog and coverage model state what monitoring, investigation, response, intelligence, hunting, and support services exist, who receives them, and when they operate.

Workforce practice · Intermediate

SOC Staffing and Escalation

SOC staffing and escalation align roles, competencies, shift coverage, authority, backup depth, and escalation paths with the services the SOC promises to deliver.

Strategic planning practice · Advanced

SOC Strategic Planning

SOC strategic planning converts risk, maturity evidence, performance, technology change, and service demand into sequenced capability outcomes, investments, and accountable milestones.

Hardening practice · Intermediate

SOC Technology Hardening

SOC technology hardening protects the monitoring and response stack with least privilege, segmentation, secure configuration, audit logging, resilient access, and controlled administration.

Integration practice · Intermediate

SOC Tool Integration

SOC tool integration connects telemetry, enrichment, analytics, case management, orchestration, and response while preserving identity, integrity, timing, and provenance across interfaces.

ATT&CK Campaign Analysis · Intermediate

SPACEHOP Activity (C0052)

A defensive guide to the Enterprise ATT&CK campaign record C0052, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity conducted through commercially leased virtual-private-server operational-relay-box networks.

ATT&CK Campaign Analysis · Intermediate

Salesforce Data Exfiltration (C0059)

A defensive guide to the Enterprise ATT&CK campaign record C0059, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign beginning in 2024 that used voice phishing to compromise Salesforce instances for data theft and extortion.

Operational process · Intermediate

Secure Change Management

Secure change management brings planning, review, testing, communication, evidence, and recovery into normal operational change.

Communications control · Intermediate

Secure Incident Communications

Secure incident communications provide trusted channels, controlled membership, identity verification, and resilient alternatives for coordinating a response.

Security telemetry · Intermediate

Secure Logging Pipelines

Secure logging pipelines move events from producers through collection, transport, parsing, storage, and analysis while preserving integrity, timing, availability, context, and access control.

Automation governance practice · Intermediate

Security Automation and Analyst Burnout

Security automation can reduce repetitive work and inconsistency, but it must be governed so brittle workflows, hidden failure, alert acceleration, or loss of analyst judgment do not increase burnout.

Data engineering practice · Intermediate

Security Data Collection Pipelines

Security data collection pipelines move telemetry from diverse sources through secure transport, buffering, parsing, normalization, quality checks, storage, and access controls.

Data engineering practice · Intermediate

Security Data Enrichment

Security data enrichment adds asset, identity, vulnerability, threat, geography, ownership, and business context so analysts can make faster and more accurate decisions.

Security platform · Intermediate

Security Information and Event Management

A SIEM centralizes selected security and operational data so teams can search, correlate, detect, investigate, report, and retain evidence across systems.

Operational practice · Beginner

Security Logging and Monitoring

Security logging records relevant activity, while monitoring evaluates that activity for conditions that require attention, investigation, or action.

Detection assurance practice · Advanced

Security Monitoring Coverage Validation

Monitoring coverage validation confirms that required events are generated, collected, parsed, retained, correlated, alerted, and investigated across the intended environment.

Security platform · Intermediate

Security Orchestration, Automation, and Response

SOAR coordinates tools, data, decisions, and repeatable response steps through playbooks that can assist analysts or perform approved actions automatically.

Data strategy practice · Intermediate

Security Telemetry Prioritization

Security telemetry prioritization ranks data sources by decision value, threat coverage, business relevance, quality, cost, retention needs, and operational feasibility.

Security operations planning concept · Intermediate

Security Telemetry Strategy

A security telemetry strategy defines which events, states, and contextual data an organization must collect to prevent, detect, investigate, respond to, and learn from priority threat and failure scenarios.

NIST CSF Subcategory profile · Intermediate

Select and Perform Recovery Actions (RC.RP-02) — NIST CSF 2.0 Subcategory

Apply RC.RP-02 to achieve this CSF 2.0 outcome: Recovery actions are selected, scoped, prioritized, and performed.

Operational monitoring · Intermediate

Server Monitoring and Alerting

Server monitoring and alerting convert metrics, logs, events, health checks, and capacity trends into actionable notifications tied to service impact and response ownership.

Facility monitoring · Intermediate

Server-Room Environmental Monitoring

Server-room environmental monitoring detects temperature, humidity, airflow, water, smoke, power, and access conditions early enough for operators to protect equipment and service continuity.

Service management · Intermediate

Service Desk Practice

The service desk is the communication and coordination point between service providers and users for incidents, requests, questions, updates, and experience feedback.

Service management · Intermediate

Service Request Management Practice

Service request management handles predefined, user-initiated requests through clear models, approvals, fulfillment steps, communication, and measurement.

Reliability engineering · Advanced

Service-Level Objectives and Error Budgets

Service-level objectives define measurable reliability targets, while error budgets express how much unreliability is acceptable over a period before delivery priorities must change.

AI security operations · Advanced

Shadow AI Discovery and Response

Shadow AI discovery and response identifies unauthorized AI tools, models, agents, extensions, data flows, and automated uses, then brings them under governance or removes them.

ATT&CK Campaign Analysis · Intermediate

ShadowRay (C0045)

A defensive guide to the Enterprise ATT&CK campaign record C0045, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign beginning in late 2023 that exploited exposed Ray AI framework instances across several sectors.

NIST CSF Subcategory profile · Intermediate

Share Incident Information (RS.CO-03) — NIST CSF 2.0 Subcategory

Apply RS.CO-03 to achieve this CSF 2.0 outcome: Information is shared with designated internal and external stakeholders.

NIST CSF Subcategory profile · Intermediate

Share Public Recovery Updates (RC.CO-04) — NIST CSF 2.0 Subcategory

Apply RC.CO-04 to achieve this CSF 2.0 outcome: Public updates on incident recovery are shared using approved methods and messaging.

ATT&CK Campaign Analysis · Intermediate

SharePoint ToolShell Exploitation (C0058)

A defensive guide to the Enterprise ATT&CK campaign record C0058, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing July 2025 exploitation waves against incompletely patched on-premises Microsoft SharePoint servers.

Security operations practice · Intermediate

Sigma Rules

Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Operating discipline · Advanced

Site Reliability Engineering

Site reliability engineering applies software engineering, automation, measurement, and risk-based reliability practices to operate services at scale.

Network detection concept · Advanced

Snort and Suricata Rules

Snort and Suricata rules describe network traffic conditions that an intrusion detection or prevention engine can alert on, record, reject, or otherwise handle using protocol, flow, content, metadata, and state-aware inspection.

ATT&CK Campaign Analysis · Intermediate

SolarWinds Compromise (C0024)

A defensive guide to the Enterprise ATT&CK campaign record C0024, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing the 2020 APT29 supply-chain operation involving the SolarWinds Orion software build process and follow-on access.

Scenario response practice · Advanced

Supply Chain Incident Response

Supply chain incident response coordinates investigation and containment when a vendor, dependency, update channel, service provider, or trusted product may be compromised.

Security operations practice · Intermediate

Sysmon

Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Proactive analysis · Advanced

Threat Hunting

Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.

Detection engineering practice · Advanced

Threat-Intelligence-Driven Detection Engineering

Threat-intelligence-driven detection engineering translates adversary behaviors, tools, infrastructure, and expected data into testable analytics and monitoring coverage.

NIST CSF Subcategory profile · Intermediate

Triage and Validate Incident Reports (RS.MA-02) — NIST CSF 2.0 Subcategory

Apply RS.MA-02 to achieve this CSF 2.0 outcome: Incident reports are triaged and validated.

ATT&CK Campaign Analysis · Intermediate

Triton Safety Instrumented System Attack (C0030)

A defensive guide to the Enterprise ATT&CK campaign record C0030, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign against a petrochemical organization that targeted Triconex safety controllers with the Triton framework.

NIST CSF Subcategory profile · Intermediate

Understand Event Impact and Scope (DE.AE-04) — NIST CSF 2.0 Subcategory

Apply DE.AE-04 to achieve this CSF 2.0 outcome: The estimated impact and scope of adverse events are understood.

ATT&CK Campaign Analysis · Intermediate

Unitronics Defacement Campaign (C0031)

A defensive guide to the Enterprise ATT&CK campaign record C0031, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing global intrusions that defaced Unitronics Vision Series PLC human-machine interfaces across multiple sectors.

Behavioral analytics concept · Advanced

User and Entity Behavior Analytics

User and Entity Behavior Analytics models activity for users, devices, workloads, applications, and other entities to identify statistically or contextually unusual behavior that may indicate compromise, misuse, control failure, or operational change.

Analyst tool guide · Intermediate

Using MITRE ATT&CK® Navigator

How Navigator layers can visualize threat intelligence, detection coverage, red-team plans, assessment results, and prioritized engineering work without misrepresenting uncertainty.

Detection engineering method · Intermediate

Using MITRE ATT&CK® for Detection Engineering

How to translate behaviors into hypotheses, data requirements, analytics, tests, tuning criteria, response actions, and measurable coverage.

NIST CSF Subcategory profile · Intermediate

Verify Backups and Restoration Assets (RC.RP-03) — NIST CSF 2.0 Subcategory

Apply RC.RP-03 to achieve this CSF 2.0 outcome: The integrity of backups and other restoration assets is verified before using them for restoration.

NIST CSF Subcategory profile · Intermediate

Verify Restored Assets and Normal Operations (RC.RP-05) — NIST CSF 2.0 Subcategory

Apply RC.RP-05 to achieve this CSF 2.0 outcome: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed.

ATT&CK Campaign Analysis · Intermediate

Versa Director Zero Day Exploitation (C0039)

A defensive guide to the Enterprise ATT&CK campaign record C0039, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing 2024 zero-day exploitation of Versa Director servers at service providers for credential capture and follow-on access.

ATT&CK Campaign Analysis · Intermediate

Water Curupira Pikabot Distribution (C0037)

A defensive guide to the Enterprise ATT&CK campaign record C0037, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing 2023 Pikabot distribution activity linked to Black Basta ransomware deployment through malicious email attachments.

Security operations practice · Intermediate

Windows Event Logs

Windows Event Logs is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Malware detection concept · Advanced

YARA Rules

YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.