CSA (312-39) SOC Simulation Lab

Master the Threat Intelligence Lifecycle to effectively operationalize raw feeds. In this lab, you'll guide a junior analyst through the critical phase of data normalization.

Scenario Context

You are a Tier 3 Threat Intelligence Analyst at Christine Group of Industries. Your team just received a massive, unstructured data dump from an industry ISAC regarding a new ransomware campaign targeting your sector.

The collection includes raw PCAPs, unstructured PDF reports, and messy CSVs. Banter, a junior threat analyst, is working in the terminal to parse out defanged URLs (e.g., hXXp://malicious[.]com), normalize timestamps to UTC, and translate the indicators of compromise (IOCs) into STIX 2.1 JSON format so your MISP instance and SIEM can ingest them.

Security Environment

Workstation: soc-ti-parser-01
Current Task: Data Normalization & Enrichment Pipeline

banter@soc-ti-parser-01:~/isac_feed$ cat raw_osint_feed.txt | grep -aEo '([0-9]{1,3}\.){3}[0-9]{1,3}' > extracted_ips.csv
banter@soc-ti-parser-01:~/isac_feed$ python3 stix_formatter.py --input extracted_ips.csv --output structured_feed.json
# Initiating STIX 2.1 translation...
[+] Extracted 4,102 raw observables.
[+] Re-arming defanged domains (replacing [.] with .)...
[+] Normalizing timestamps from EST to UTC...
[+] Structuring data complete. Output ready for Sentinel ingestion.
banter@soc-ti-parser-01:~/isac_feed$ _

The SIEM cannot read unstructured PDFs. Banter is bridging the gap between raw data and analyzable intelligence.

Question

Banter is a threat analyst in Christine Group of Industries. As a part of the job, he is currently formatting and structuring the raw data.

He is at which stage of the threat intelligence life cycle?

SOC Hint: Think about the chronological order. The data has already been gathered, but it hasn't been studied yet to draw conclusions. What is the intermediate step where we clean and organize the data so the analytics engine can read it?

Expert Insight: Senior SOC Analyst Mentorship

What is happening:
In SOC operations, raw threat feeds are incredibly noisy. An analyst receiving a 50-page PDF report from an ISAC cannot just "upload" it to Sentinel or Splunk. The data must be decrypted, translated, parsed (using regex to find IPs/Hashes), and mapped to a schema (like STIX or Elastic Common Schema). Banter is currently performing this exact normalization work.

Why B is correct:
The Processing and Exploitation phase of the Threat Intelligence Lifecycle is specifically defined as taking raw, collected data and converting it into a structured format that can be used by human analysts or automated systems. Formatting, structuring, decrypting, and translating all occur here.

Why the others are wrong:

Collection (Option C): This is the previous step. Collection is the act of acquiring the raw PDFs, subscribing to the TAXII feed, or scraping the dark web.
Analysis and Production (Option D): This is the next step. Once Banter's data is structured into JSON, human logic is applied. The analyst looks at the structured data and says, "These IPs belong to APT29, and they target our sector."
Dissemination and Integration (Option A): This is the final step. After analysis, the finalized intelligence report is shared with stakeholders, or the IOCs are integrated into EDR blocklists.

SOC Mini-Lesson: The Processing Bottleneck

In modern SOCs, the "Processing" phase is often the biggest bottleneck. Organizations collect far more data than they can process.

To survive, Tier 3 analysts rely heavily on SOAR (Security Orchestration, Automation, and Response) platforms and data pipelining tools (like Cribl, Logstash, or custom Python scripts) to automate the Processing phase. If an analyst has to manually copy-paste IP addresses from a PDF into a SIEM watchlist, the intelligence is already stale before the analysis phase even begins.

Ready to validate your skills further?
Explore more CSA simulations by ExamRange →