Which items are included in intelligence development?

Which items are included in intelligence development?

• A. Tools, techniques, and procedures; Understanding adversary intent; Malware gathering; IOC Development; Campaign identification.
• B. Adversary network segmentation.
• C. Bit mangling.
• D. Data decoy.

Answer: (A)

Intelligence development involves turning raw threat data into structured, actionable knowledge about who the adversary is, what they do, and how to detect and respond to them. The items listed fit this process because they build a clear picture of attacker behavior and intent: Tools, techniques, and procedures describe how attackers operate and what signals to look for; understanding adversary intent helps prioritize threats and understand motivation; malware gathering provides samples and behaviors that reveal capabilities and inform detections; IOC development yields concrete indicators to monitor in your environment; campaign identification links separate intrusions into a broader activity stream, revealing scope, infrastructure, and timelines. Together, these elements convert disparate data into meaningful intelligence that guides defense decisions. The other options don’t fit the intelligence development focus: adversary network segmentation is about defensive network architecture, not producing intelligence; bit mangling isn’t a recognized component of threat intelligence development; data decoy relates to deception or honeypot tactics rather than building structured threat intelligence.

Intelligence development involves turning raw threat data into structured, actionable knowledge about who the adversary is, what they do, and how to detect and respond to them. The items listed fit this process because they build a clear picture of attacker behavior and intent: Tools, techniques, and procedures describe how attackers operate and what signals to look for; understanding adversary intent helps prioritize threats and understand motivation; malware gathering provides samples and behaviors that reveal capabilities and inform detections; IOC development yields concrete indicators to monitor in your environment; campaign identification links separate intrusions into a broader activity stream, revealing scope, infrastructure, and timelines. Together, these elements convert disparate data into meaningful intelligence that guides defense decisions.

The other options don’t fit the intelligence development focus: adversary network segmentation is about defensive network architecture, not producing intelligence; bit mangling isn’t a recognized component of threat intelligence development; data decoy relates to deception or honeypot tactics rather than building structured threat intelligence.