You use GTI to identify cyber threats and think your organization may have been targeted by a cyber crime group. What should you do to determine if your organization has been victimized?

• A. Review Threat Landscape for groups active in your industry; research MITRE ATT&CK TTPs; implement detections.
• B. In Reports & Analysis, extract IOCs from recent reports, implement detection rules/lists in SecOps to identify presence.
• C. Implement monitors in Digital Threat Monitoring for compromised credentials, dark web mentions, or data leaks.
• D. In Vulnerability Intelligence, identify high/critical vulnerabilities in products/technologies your org uses.

Answer: (B)

Translating threat intelligence into actionable detections is the way to confirm whether you’ve actually been victimized. When you suspect targeted activity, you want to pull indicators of compromise from recent reports and analyses related to the suspected cybercrime group. Those IOCs—such as file hashes, malicious domains, IP addresses, and other observable artifacts—are what you can hunt for in your environment.

By implementing detection rules or detector lists in your SecOps tooling based on those IOCs, you turn external intel into concrete monitoring. If any IOC matches appear in your endpoints, networks, or logs, you’ve got evidence of compromise and can escalate to containment and incident response. This makes the intel operational and directly answers whether the attacker has already been inside your environment.

Other approaches—looking at general threat landscapes and MITRE ATT&CK mappings, monitoring for credential compromises or dark web chatter, or reviewing vulnerability intel—are valuable for planning and risk assessment, but they don’t provide a direct method to verify if your organization has been victimized. They identify potential risk or exposure rather than confirm a current intrusion through concrete in-network indicators.