Tutorial 5: Threat Intelligence and Metrics

Unit 7 ยท Monitoring and incident response

Objectives

Threat intelligence can describe actors, techniques, indicators, vulnerabilities, and campaigns. An indicator without context has limited value; assess source reliability, freshness, confidence, affected technology, and actionability. Map useful intelligence to controls, detections, blocking, hunting, or awareness.

signal -> context + confidence -> decision
metric: critical exposure age, privileged MFA coverage, MTTD, MTTR

Metrics should support decisions. Counting blocked events can encourage noise; measuring remediation age, control coverage, detection quality, and recovery performance better reflects enterprise risk. Report trends, thresholds, uncertainty, and outcomes.

Exercises

  1. Evaluate three intelligence reports.
  2. Map one technique to prevention and detection.
  3. Replace vanity metrics with risk-relevant measures.

Self-check

  1. What makes intelligence actionable?
  2. Why freshness matters?
  3. What does MTTR measure?

Self-Check Quiz

1. Is an IP address alone proof of malicious activity?

AnswerNo. It needs context, confidence, time, behavior, and affected assets.

2. Why measure control outcomes?

AnswerActivity counts do not show whether exposure or recovery capability improved; outcome measures support better decisions.

Homework

  1. Design a threat-intelligence workflow for an enterprise SOC.
  2. Define six risk-relevant metrics.
  3. Explain one metric's limitation.
Sample answerIngest relevant, fresh intelligence, validate it, map techniques to detections and controls, assign owners, and retire stale indicators. Metrics may include critical vulnerability age, MFA coverage, MTTD, MTTR, privileged review completion, and restore-test success; each needs scope and interpretation.