CISSP 17.4 - Automating Incident Response (Part 2 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series turns to threat intelligence in Domain 7 and how it ties the whole defensive picture together. It covers how organizations shift from reacting to attacks toward anticipating them, and how that foresight feeds into everything else already built for prevention, detection, and response.

Frequently Asked Questions

What is threat intelligence?

Threat intelligence is the practice of gathering data about current and potential threats from many sources, then turning it into timely, usable knowledge. Organizations use it to actively hunt for threats rather than passively wait. The point is not just collecting raw data but extracting what actually helps you defend, like which domains, addresses, or malware are dangerous right now, much like a weather service that does not just record conditions but forecasts the storm so you can prepare before it hits.

What is the kill chain, and how do you break it?

The kill chain describes an attack as an ordered sequence of stages adapted from a military model, running from reconnaissance, to weaponization, to delivery, to exploitation, to installation, to command and control, and finally to actions on objectives. The crucial insight is that every stage depends on the ones before it, so breaking the chain at any single link collapses the whole attack. If users dodge the phishing at the delivery stage, the weapon never lands and the attacker fails.

What is the MITRE attack matrix?

It is a knowledge base of the tactics, techniques, and procedures that real attackers use, and it complements kill chain models. The key difference is structure: a kill chain is an ordered sequence, but the attack matrix is not ordered, laying out tactics like reconnaissance, persistence, privilege escalation, lateral movement, and exfiltration side by side with specific techniques under each. It is a living document, and a companion framework focuses on adversarial attacks against artificial intelligence and machine learning systems.

What are threat feeds and threat hunting?

A threat feed is a steady stream of raw data about current and potential threats, and a threat intelligence feed refines it into actionable items like suspicious domains, known malware hashes, and malicious addresses that you match against your own traffic. Threat hunting is actively searching your network instead of waiting for alarms, starting from the assumption that attackers are already inside; once you know what to look for, you script searches across your systems, since modern attackers often lurk quietly for months.

How do all these automation and intelligence pieces intersect?

Automation through playbooks and runbooks handles known incidents and clears routine false positives, but the danger is the false negative, the real threat that goes undetected, and the fix is keeping your systems informed of new threats. That is where threat feeds come in: when automation can ingest a feed, it updates every prevention and detection system in real time, blocking a newly reported bad domain the instant it appears. Layer machine learning and artificial intelligence on top, and the whole system keeps sharpening itself while cutting the human workload.

Reference: This article is based on concepts discussed in CISSP 17.4 - Automating Incident Response (Part 2 of 2).