Cyber Threat Intelligence (CTI) Analyst
Qu'est-ce que Cyber Threat Intelligence (CTI) Analyst ?
Cyber Threat Intelligence (CTI) AnalystA specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers.
A Cyber Threat Intelligence (CTI) analyst produces and curates the actionable intelligence layer that sits between raw threat data and security decisions. The role splits along three classical tiers. Strategic CTI summarizes adversary motivations, geopolitical context, and long-term trends for executives and board audiences. Operational CTI characterizes specific named threat actors and campaigns (TTPs, infrastructure, victimology, targeting) for SOCs, hunt teams, and IR. Tactical CTI is the day-to-day stream of IOCs, YARA/Sigma rules, ATT&CK mappings, and feed entries that detection engineering consumes. Workflow combines OSINT, paid feeds (Mandiant, CrowdStrike Falcon Intelligence, Recorded Future, Intel 471), criminal-forum monitoring, sample collection (MalwareBazaar, VirusTotal Intelligence), and internal SOC telemetry, structured using frameworks such as MITRE ATT&CK, STIX/TAXII, Diamond Model, the Pyramid of Pain, and TLP. Outputs are written reports, intelligence briefings, IOC feeds, ATT&CK navigator layers, and pre-incident hunt packages. CTI analysts often hold GIAC GCTI, SANS FOR-578, eLearnSecurity eCTHP, or Mandiant-style certifications.
● Exemples
- 01
A CTI analyst publishes a quarterly report on Scattered Spider's evolving social-engineering TTPs, mapping observed activity to MITRE ATT&CK Enterprise.
- 02
Tactical CTI feeds the SOC a YARA rule and a list of C2 domains within hours of a new XWorm variant being observed in the wild.
● Questions fréquentes
Qu'est-ce que Cyber Threat Intelligence (CTI) Analyst ?
A specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers. Cette notion relève de la catégorie Rôles et carrières en cybersécurité.
Que signifie Cyber Threat Intelligence (CTI) Analyst ?
A specialist who collects, structures, and disseminates intelligence about threat actors, campaigns, and TTPs — at strategic, operational, and tactical tiers — to inform defenders, IR teams, and executive decision-makers.
Comment fonctionne Cyber Threat Intelligence (CTI) Analyst ?
A Cyber Threat Intelligence (CTI) analyst produces and curates the actionable intelligence layer that sits between raw threat data and security decisions. The role splits along three classical tiers. Strategic CTI summarizes adversary motivations, geopolitical context, and long-term trends for executives and board audiences. Operational CTI characterizes specific named threat actors and campaigns (TTPs, infrastructure, victimology, targeting) for SOCs, hunt teams, and IR. Tactical CTI is the day-to-day stream of IOCs, YARA/Sigma rules, ATT&CK mappings, and feed entries that detection engineering consumes. Workflow combines OSINT, paid feeds (Mandiant, CrowdStrike Falcon Intelligence, Recorded Future, Intel 471), criminal-forum monitoring, sample collection (MalwareBazaar, VirusTotal Intelligence), and internal SOC telemetry, structured using frameworks such as MITRE ATT&CK, STIX/TAXII, Diamond Model, the Pyramid of Pain, and TLP. Outputs are written reports, intelligence briefings, IOC feeds, ATT&CK navigator layers, and pre-incident hunt packages. CTI analysts often hold GIAC GCTI, SANS FOR-578, eLearnSecurity eCTHP, or Mandiant-style certifications.
Comment se défendre contre Cyber Threat Intelligence (CTI) Analyst ?
Les défenses contre Cyber Threat Intelligence (CTI) Analyst combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de Cyber Threat Intelligence (CTI) Analyst ?
Noms alternatifs courants : Threat intelligence analyst, CTI researcher.
● Termes liés
- defense-ops№ 292
Renseignement sur les Menaces (CTI)
Connaissance fondée sur des preuves au sujet des adversaires, de leurs motivations et de leurs méthodes, utilisée pour orienter les décisions défensives et prioriser les contrôles.
- defense-ops№ 1268
Renseignement sur les menaces
Connaissance fondée sur des preuves concernant les menaces et leurs auteurs — indicateurs, TTP et contexte — utilisée pour orienter les décisions de sécurité et la détection.
- compliance№ 762
MITRE ATT&CK
Base de connaissances mondiale et ouverte sur les tactiques et techniques d'attaque observées dans la réalité, maintenue par MITRE.
- defense-ops№ 1223
STIX
STIX est un standard OASIS qui definit un langage structure et lisible par machine pour representer et echanger la cyber threat intelligence entre organisations et outils.
- defense-ops№ 1252
TAXII Protocol
TAXII est un protocole applicatif OASIS au-dessus de HTTPS pour publier, decouvrir et consommer de la threat intelligence — generalement du contenu STIX — entre organisations.
- roles№ 1266
Threat Hunter
Défenseur senior qui recherche proactivement, dans la télémétrie de l'entreprise, l'activité d'adversaires ayant contourné les détections en place, à l'aide d'hypothèses, de renseignement et d'analyse comportementale.