Cyber Threat Intelligence (CTI) Analyst
Was ist Cyber Threat Intelligence (CTI) Analyst?
Cyber Threat Intelligence (CTI) AnalystA specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers.
A Cyber Threat Intelligence (CTI) analyst produces and curates the actionable intelligence layer that sits between raw threat data and security decisions. The role splits along three classical tiers. Strategic CTI summarizes adversary motivations, geopolitical context, and long-term trends for executives and board audiences. Operational CTI characterizes specific named threat actors and campaigns (TTPs, infrastructure, victimology, targeting) for SOCs, hunt teams, and IR. Tactical CTI is the day-to-day stream of IOCs, YARA/Sigma rules, ATT&CK mappings, and feed entries that detection engineering consumes. Workflow combines OSINT, paid feeds (Mandiant, CrowdStrike Falcon Intelligence, Recorded Future, Intel 471), criminal-forum monitoring, sample collection (MalwareBazaar, VirusTotal Intelligence), and internal SOC telemetry, structured using frameworks such as MITRE ATT&CK, STIX/TAXII, Diamond Model, the Pyramid of Pain, and TLP. Outputs are written reports, intelligence briefings, IOC feeds, ATT&CK navigator layers, and pre-incident hunt packages. CTI analysts often hold GIAC GCTI, SANS FOR-578, eLearnSecurity eCTHP, or Mandiant-style certifications.
● Beispiele
- 01
A CTI analyst publishes a quarterly report on Scattered Spider's evolving social-engineering TTPs, mapping observed activity to MITRE ATT&CK Enterprise.
- 02
Tactical CTI feeds the SOC a YARA rule and a list of C2 domains within hours of a new XWorm variant being observed in the wild.
● Häufige Fragen
Was ist Cyber Threat Intelligence (CTI) Analyst?
A specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers. Es gehört zur Kategorie Rollen und Karriere der Cybersicherheit.
Was bedeutet Cyber Threat Intelligence (CTI) Analyst?
A specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers.
Wie funktioniert Cyber Threat Intelligence (CTI) Analyst?
A Cyber Threat Intelligence (CTI) analyst produces and curates the actionable intelligence layer that sits between raw threat data and security decisions. The role splits along three classical tiers. Strategic CTI summarizes adversary motivations, geopolitical context, and long-term trends for executives and board audiences. Operational CTI characterizes specific named threat actors and campaigns (TTPs, infrastructure, victimology, targeting) for SOCs, hunt teams, and IR. Tactical CTI is the day-to-day stream of IOCs, YARA/Sigma rules, ATT&CK mappings, and feed entries that detection engineering consumes. Workflow combines OSINT, paid feeds (Mandiant, CrowdStrike Falcon Intelligence, Recorded Future, Intel 471), criminal-forum monitoring, sample collection (MalwareBazaar, VirusTotal Intelligence), and internal SOC telemetry, structured using frameworks such as MITRE ATT&CK, STIX/TAXII, Diamond Model, the Pyramid of Pain, and TLP. Outputs are written reports, intelligence briefings, IOC feeds, ATT&CK navigator layers, and pre-incident hunt packages. CTI analysts often hold GIAC GCTI, SANS FOR-578, eLearnSecurity eCTHP, or Mandiant-style certifications.
Wie schützt man sich gegen Cyber Threat Intelligence (CTI) Analyst?
Schutzmaßnahmen gegen Cyber Threat Intelligence (CTI) Analyst kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Cyber Threat Intelligence (CTI) Analyst?
Übliche alternative Bezeichnungen: Threat intelligence analyst, CTI researcher.
● Verwandte Begriffe
- defense-ops№ 292
Cyber Threat Intelligence (CTI)
Evidenzbasiertes Wissen über Angreifer, ihre Motivationen und Methoden, das defensive Entscheidungen unterstützt und Kontrollen priorisiert.
- defense-ops№ 1268
Threat Intelligence
Evidenzbasiertes Wissen über Bedrohungen und Akteure — inklusive Indikatoren, TTPs und Kontext — zur Steuerung von Sicherheitsentscheidungen und Detection.
- compliance№ 762
MITRE ATT&CK
Global zugängliche, von MITRE gepflegte Wissensdatenbank über Taktiken und Techniken realer Angreifer.
- defense-ops№ 1223
STIX
STIX ist ein OASIS-Standard, der eine strukturierte, maschinenlesbare Sprache zum Darstellen und Austauschen von Cyber Threat Intelligence zwischen Organisationen und Tools definiert.
- defense-ops№ 1252
TAXII Protocol
TAXII ist ein OASIS-Anwendungsprotokoll uber HTTPS zum Veroffentlichen, Entdecken und Konsumieren von Cyber Threat Intelligence – typischerweise STIX-Inhalten – zwischen Organisationen.
- roles№ 1266
Threat Hunter
Erfahrener Verteidiger, der proaktiv die Telemetrie eines Unternehmens nach Angreifer-Aktivitäten durchsucht, die bestehende Detektionen umgangen haben — auf Basis von Hypothesen, Threat Intelligence und Verhaltensanalysen.