1.3Core security operations terms

SOC conversation runs on jargon, but reciting memorized definitions is useless on the job. What matters is choosing "which activity or concept fits this situation right now." Passive detection waiting for alerts differs from threat hunting, which forms a hypothesis and actively goes looking; and where to spend limited staff is guided by risk-based analysis (RBA). This section ties core terms not to definitions but to when to use them.

1.3.1Knowing, hunting, analyzing

• Threat intelligence is collected and analyzed information about attacker tradecraft, IoCs, and campaigns turned into actionable knowledge. It is the input for getting ahead of "who targets what." The key is that it is contextualized, evaluated information—not mere raw data.
• Threat hunting does not wait for alerts; it forms a hypothesis ("if compromised, this artifact would remain") and actively searches. It unearths dwelling threats that slipped past existing detection rules. It complements passive alert monitoring rather than replacing it.
• Malware analysis examines a suspicious sample's behavior/structure. It has dynamic analysis (running it in a sandbox/detonation chamber to observe behavior) and static analysis (reading code without running it); deeper static work uses reverse engineering (disassembly, etc., to recover logic).

1.3.2Adversary, priority, time window

• Threat actor is the entity that carries out attacks—thrill-seekers, hacktivists, financially motivated cybercriminals, state-sponsored (APT), insiders, etc.—differing in motive and capability. Assuming an adversary (who, and why) narrows the assets to protect and realistic threat scenarios.
• Risk-based analysis (RBA) allocates limited resources by prioritizing where likelihood x impact is highest. Rather than protecting everything equally, it concentrates staff and controls on critical assets and realistic threats. It underpins triage and patch prioritization.
• Sliding window evaluates events over a fixed-width time window that shifts gradually. It is used for within-window aggregation/correlation like "100 failures from one source in the last 5 minutes," capturing trends of sustained or gradual attacks (brute force, slow attacks) that instantaneous values miss.

1.3.3Building it into design

• Threat modeling systematically enumerates "where it could be attacked and what could happen" at the design stage and builds in countermeasures up front (via frameworks like STRIDE). Rather than defending after building, it evaluates the design from the attacker's viewpoint to eliminate weaknesses.
• DevSecOps integrates development, security, and operations, embedding security early and continuously (shift-left) into the pipeline. Instead of inspecting all at once after release, it continuously and automatically scans for vulnerabilities at commit/build time.

Your SOC receives an industry threat intelligence feed reporting that "peers are being targeted by an actor who breaks in by abusing legitimate remote-management tools, dwells for weeks, then exfiltrates data." Merely waiting passively for alerts risks being too late, since this actor is assumed to slip past existing rules. The right next move is threat hunting: from the intelligence you form a hypothesis—"if we too are compromised, a legitimate management tool would start on unusual devices/hours and leave traces of periodic external traffic"—and actively search EDR and logs. A sliding window helps the aggregation ("count hosts where a tool normally not run outside admin devices started in the last 24 hours"). On finding a suspicious sample, you first grasp its C2 and persistence behavior via dynamic analysis (sandbox), and if heavily obfuscated, pin down its internal logic via reverse engineering. But with no staff to scrutinize every device at once, RBA prioritizes the search on "critical assets holding customer data + devices matching the intelligence's tradecraft." Who the adversary is (the threat actor's motive—financially motivated dwellers or state-sponsored) changes the assumed dwell time and lateral-movement scenarios. As a root fix, you enumerate this "legitimate-tool abuse" attack surface via threat modeling in the design and continuously weave detection/restriction of management-tool use into the DevSecOps pipeline and policy. This chain of judgment—know via intelligence, search via hunting, prioritize via RBA, unmask via analysis, and anticipate via modeling and DevSecOps—turns the terms into usable tools.

1.3.4Section summary

• Know via threat intelligence (actionable knowledge) and dig out dwellers via threat hunting (hypothesis-driven active search); hunting complements waiting for alerts
• Malware analysis is dynamic (sandbox) and static (reverse engineering); staff allocation uses RBA (likelihood x impact) and period aggregation uses a sliding window
• Threat modeling anticipates the attack surface at design, and DevSecOps continuously embeds security into the pipeline via shift-left