Operational intelligence focuses on the "how" and "why" of an attack. A report detailing a specific threat actor's typical behaviors (their Tactics, Techniques, and Procedures or TTPs) and intent (their motivation and goals) is a classic example of operational CTI. This type of intelligence helps security teams, such as incident responders and threat hunters, understand an adversary's methodology. This enables them to anticipate future attacks and build more resilient and proactive defense strategies against specific, known threats. It provides context beyond simple indicators of compromise.

B. Executive: This is not a standard CTI category; it is typically used as a synonym for Strategic intelligence, which is tailored for a high-level, non-technical audience.

C. Tactical: Tactical intelligence is focused on immediate threats and is highly technical, consisting primarily of specific indicators of compromise (IOCs) like malicious IP addresses, file hashes, or domains for automated blocking.

D. Strategic: Strategic intelligence is high-level, non-technical, and focuses on the broader threat landscape, long-term trends, and potential business impact to inform executive decision-making and risk management.

1. Splunk

"What Is Cyber Threat Intelligence?" Blog

October 26

2022.

Section: The Three Types of Cyber Threat Intelligence. The article defines Operational Intelligence as providing "insights into the 'who

' 'what

' and 'how' of a cyberattack... [it] details the tactics

techniques and procedures (TTPs) of specific threat actors." This directly matches the question's description of a report on a threat actor's behaviors and intent.

2. National Institute of Standards and Technology (NIST)

"NISTIR 8296 (Draft) - Cybersecurity Framework 2.0 Core with Implementation Examples

" February 2024.

Section: ID.RA-P10

Page 31. In the implementation examples for threat intelligence

it describes different levels. The description for understanding "threat actor TTPs

capabilities

and infrastructure" to inform defense aligns with the concept of operational intelligence

which is more detailed than strategic but broader than tactical IOCs.

3. Roberts

S. J.

& Brown

R. (2017). Intelligence-Driven Incident Response: Outwitting the Adversary. O'Reilly Media.

Chapter 2

Section: "Levels of Intelligence." The authors (who are Splunk employees) define operational intelligence as focusing on "details of the operations of a specific adversary

" including their TTPs and infrastructure. This is precisely what the report in the question describes. It contrasts with tactical intelligence

which is defined as focusing on "real-time or near-real-time indicators."