Phase 6 of 7
Analyze
Intelligence Analysis
Transform raw adversary interaction data into structured intelligence. Map observed behaviors to known frameworks, extract indicators of compromise, reconstruct attack paths, and produce intelligence products that directly strengthen your defense posture.
Analysis is where deception data becomes intelligence. The raw telemetry captured during the detection phase, connection logs, command histories, file access patterns, tool deployment artifacts, is valuable, but it requires structured analysis to become actionable.
The analysis phase applies intelligence tradecraft to deception data. This starts with extracting and cataloging the techniques, tactics, and procedures that adversaries demonstrated while interacting with deception assets. Did they use credential stuffing or password spraying against the decoy authentication service? Did they attempt privilege escalation on the honeypot, and if so, which exploits did they try? Did they exfiltrate data, and through what channels?
Mapping these observations to the MITRE ATT&CK framework creates a common language for communicating findings across the organization and the broader security community. It also enables gap analysis: if adversaries are using techniques that your production detection rules do not cover, that gap needs to be addressed urgently.
Beyond TTP mapping, analysis involves extracting indicators of compromise: IP addresses, domain names, file hashes, command-and-control patterns, and tool signatures. These IOCs feed directly into threat intelligence platforms and can be shared with industry peers through established sharing mechanisms.
Perhaps the most valuable analytical output is attack path reconstruction. By analyzing how an adversary moved through the deception environment, which assets they visited in what order, what they searched for, what they prioritized, defenders gain insight into the adversary's objectives and operational playbook. This intelligence is extraordinarily difficult to obtain through any other means and directly informs how production defenses should be strengthened.
The analysis phase also involves a critical assessment of deception effectiveness: which assets attracted interaction, which were ignored, and what does that tell us about adversary priorities and our deployment strategy?
Objectives
- Extract and catalog adversary TTPs from raw deception interaction data
- Map observed behaviors to MITRE ATT&CK techniques for standardized communication
- Harvest indicators of compromise for integration with threat intelligence platforms
- Reconstruct complete attack paths through the deception environment
- Assess adversary sophistication and likely attribution based on observed tradecraft
- Evaluate deception operation effectiveness and identify areas for improvement
Key Questions
- Q1What TTPs did the adversary demonstrate, and do our production detection rules cover them?
- Q2Are the extracted IOCs actionable, and have they been validated against false positive risk?
- Q3What does the adversary attack path tell us about their objectives and priorities?
- Q4Which deception assets generated the most valuable intelligence, and which were ineffective?
- Q5How does this adversary activity correlate with existing threat intelligence about known threat actors?
Inputs
- Behavioral telemetry and interaction logs from the detection phase
- Correlated incident records
- MITRE ATT&CK framework for TTP mapping
- Existing threat intelligence for correlation and attribution
Outputs
- Structured TTP reports mapped to MITRE ATT&CK
- Validated indicators of compromise with confidence ratings
- Attack path reconstruction diagrams
- Adversary capability and sophistication assessment
- Deception operation effectiveness report with recommendations
- Intelligence products for stakeholder consumption
Techniques in this Phase(6)
SDF-AN01
TTP Extraction and Cataloging
Systematically extract techniques, tactics, and procedures from raw deception telemetry and catalog them in a structured format. This transforms unstructured interaction data into organized intelligence that can be compared across incidents and used to develop detection rules.
SDF-AN02
MITRE ATT&CK Correlation
Map observed adversary behaviors to the MITRE ATT&CK framework to create a standardized representation of adversary activity. This mapping enables comparison with known threat actor profiles, identification of detection gaps, and communication with the broader security community.
SDF-AN03
IOC Harvesting
Extract indicators of compromise from adversary interactions with deception assets. These IOCs, including IP addresses, domain names, file hashes, tool signatures, and behavioral patterns, feed into threat intelligence platforms and detection systems to provide ongoing protection.
SDF-AN04
Attack Path Reconstruction
Reconstruct the complete path an adversary took through the deception environment: which assets they interacted with, in what order, what they searched for at each stop, and how long they spent at each stage. This reconstruction reveals adversary objectives, priorities, and decision-making patterns.
SDF-AN05
Adversary Capability Assessment
Assess the sophistication, resources, and operational capabilities of adversaries based on their observed behavior in the deception environment. This assessment informs defensive investment decisions and risk management priorities.
SDF-AN06
Intelligence Report Synthesis
Synthesize all analysis outputs into structured intelligence reports tailored to different audiences: technical reports for SOC teams, executive summaries for leadership, and structured data for threat intelligence platforms.