Protection and Defense
PD-WRL-006

Threat Analysis

Responsible for collecting, processing, analyzing, and disseminating cybersecurity threat assessments. Develops cybersecurity indicators to maintain awareness of the status of the highly dynamic operating environment.

  • T0569: Answer requests for information
  • T0685: Evaluate threat decision-making processes
  • T0698: Facilitate continuously updated intelligence, surveillance, and visualization input to common operational picture managers
  • T0707: Generate requests for information
  • T0718: Identify intelligence gaps and shortfalls
  • T0751: Monitor open source websites for hostile content directed towards organizational or partner interests
  • T0845: Identify cyber threat tactics and methodologies
  • T1020: Determine the operational and safety impacts of cybersecurity lapses
  • T1035: Determine how threat activity groups employ encryption to support their operations
  • T1053: Identify and characterize intrusion activities against a victim or target
  • T1054: Scope analysis reports to various audiences that accounts for data sharing classification restrictions
  • T1055: Determine if priority information requirements are satisfied
  • T1640: Determine effectiveness of intelligence collection operations
  • T1641: Recommend adjustments to intelligence collection strategies
  • T1643: Develop common operational pictures
  • T1644: Develop cyber operations indicators
  • T1645: Coordinate all-source collection activities
  • T1646: Validate all-source collection requirements and plans
  • T1647: Develop priority information requirements
  • T1651: Prepare threat and target briefings
  • T1652: Prepare threat and target situational updates
  • T1686: Identify intelligence requirements
  • T1762: Modify collection requirements
  • T1763: Determine effectiveness of collection requirements
  • T1765: Monitor changes to designated cyber operations warning problem sets
  • T1766: Prepare change reports for designated cyber operations warning problem sets
  • T1767: Monitor threat activities
  • T1768: Prepare threat activity reports
  • T1770: Report on adversarial activities that fulfill priority information requirements
  • T1772: Identify indications and warnings of target communication changes or processing failures
  • T1775: Prepare cyber operations intelligence reports
  • T1776: Prepare indications and warnings intelligence reports
  • T1792: Assess effectiveness of intelligence production
  • T1793: Assess effectiveness of intelligence reporting
  • T1798: Provide intelligence analysis and support
  • T1799: Notify appropriate personnel of imminent hostile intentions or activities
  • T1804: Prepare network intrusion reports
  • T1835: Determine if intelligence requirements and collection plans are accurate and up-to-date
  • K0018: Knowledge of encryption algorithms
  • K0480: Knowledge of malware
  • K0655: Knowledge of intelligence fusion
  • K0658: Knowledge of cognitive biases
  • K0674: Knowledge of computer networking protocols
  • K0675: Knowledge of risk management processes
  • K0676: Knowledge of cybersecurity laws and regulations
  • K0677: Knowledge of cybersecurity policies and procedures
  • K0678: Knowledge of privacy laws and regulations
  • K0679: Knowledge of privacy policies and procedures
  • K0680: Knowledge of cybersecurity principles and practices
  • K0681: Knowledge of privacy principles and practices
  • K0682: Knowledge of cybersecurity threats
  • K0683: Knowledge of cybersecurity vulnerabilities
  • K0684: Knowledge of cybersecurity threat characteristics
  • K0689: Knowledge of network infrastructure principles and practices
  • K0690: Knowledge of requirements analysis principles and practices
  • K0697: Knowledge of encryption algorithm capabilities and applications
  • K0718: Knowledge of network communications principles and practices
  • K0719: Knowledge of human-computer interaction (HCI) principles and practices
  • K0751: Knowledge of system threats
  • K0752: Knowledge of system vulnerabilities
  • K0766: Knowledge of data asset management principles and practices
  • K0773: Knowledge of telecommunications principles and practices
  • K0786: Knowledge of physical computer components
  • K0787: Knowledge of computer peripherals
  • K0788: Knowledge of adversarial tactics principles and practices
  • K0789: Knowledge of adversarial tactics tools and techniques
  • K0790: Knowledge of adversarial tactics policies and procedures
  • K0792: Knowledge of network configurations
  • K0806: Knowledge of machine virtualization tools and techniques
  • K0812: Knowledge of digital communication systems and software
  • K0818: Knowledge of new and emerging cybersecurity risks
  • K0825: Knowledge of threat vector characteristics
  • K0831: Knowledge of network attack vectors
  • K0844: Knowledge of cyber attack stages
  • K0845: Knowledge of cyber intrusion activity phases
  • K0857: Knowledge of malware analysis tools and techniques
  • K0858: Knowledge of virtual machine detection tools and techniques
  • K0865: Knowledge of data classification standards and best practices
  • K0866: Knowledge of data classification tools and techniques
  • K0915: Knowledge of network architecture principles and practices
  • K0916: Knowledge of malware analysis principles and practices
  • K0925: Knowledge of wireless communication tools and techniques
  • K0926: Knowledge of signal jamming tools and techniques
  • K0934: Knowledge of data classification policies and procedures
  • K0960: Knowledge of content management system (CMS) capabilities and applications
  • K0969: Knowledge of cyber-attack tools and techniques
  • K0983: Knowledge of computer networking principles and practices
  • K0984: Knowledge of web security principles and practices
  • K0989: Knowledge of intelligence information repositories
  • K0990: Knowledge of cyber operations principles and practices
  • K0994: Knowledge of denial and deception tools and techniques
  • K1002: Knowledge of supervisory control and data acquisition (SCADA) systems and software
  • K1005: Knowledge of intelligence collection capabilities and applications
  • K1007: Knowledge of intelligence requirements tasking systems and software
  • K1008: Knowledge of intelligence support activities
  • K1009: Knowledge of threat intelligence principles and practices
  • K1010: Knowledge of intelligence policies and procedures
  • K1011: Knowledge of network addressing principles and practices
  • K1014: Knowledge of network security principles and practices
  • K1019: Knowledge of operations security (OPSEC) principles and practices
  • K1025: Knowledge of decision-making policies and procedures
  • K1028: Knowledge of target development principles and practices
  • K1035: Knowledge of target research tools and techniques
  • K1049: Knowledge of routing protocols
  • K1059: Knowledge of request for information processes
  • K1066: Knowledge of threat behaviors
  • K1067: Knowledge of target behaviors
  • K1068: Knowledge of threat systems and software
  • K1069: Knowledge of virtual machine tools and technologies
  • K1100: Knowledge of analytical tools and techniques
  • K1101: Knowledge of analytics
  • K1109: Knowledge of virtual collaborative workspace tools and techniques
  • K1113: Knowledge of blue force tracking
  • K1197: Knowledge of priority intelligence requirements
  • S0111: Skill in interfacing with customers
  • S0194: Skill in conducting non-attributable research
  • S0385: Skill in communicating complex concepts
  • S0430: Skill in collaborating with others
  • S0433: Skill in creating analytics
  • S0434: Skill in extrapolating from incomplete data sets
  • S0435: Skill in analyzing large data sets
  • S0436: Skill in creating target intelligence products
  • S0438: Skill in functioning effectively in a dynamic, fast-paced environment
  • S0443: Skill in mitigating cognitive biases
  • S0444: Skill in mitigating deception in reporting and analysis
  • S0446: Skill in mimicking threat actors
  • S0472: Skill in developing virtual machines
  • S0473: Skill in maintaining virtual machines
  • S0494: Skill in performing operational environment analysis
  • S0505: Skill in performing intrusion data analysis
  • S0506: Skill in identifying customer information needs
  • S0509: Skill in evaluating security products
  • S0511: Skill in establishing priorities
  • S0512: Skill in extracting metadata
  • S0514: Skill in preparing operational environments
  • S0516: Skill in performing threat emulation tactics
  • S0517: Skill in anticipating threats
  • S0535: Skill in performing threat factor analysis
  • S0537: Skill in designing wireless communications systems
  • S0540: Skill in identifying network threats
  • S0555: Skill in performing capabilities analysis
  • S0556: Skill in performing requirements analysis
  • S0579: Skill in preparing reports
  • S0600: Skill in collecting relevant data from a variety of sources
  • S0633: Skill in developing position qualification requirements
  • S0673: Skill in translating operational requirements into security controls
  • S0696: Skill in conducting deep web research
  • S0702: Skill in defining an operational environment
  • S0704: Skill in performing target analysis
  • S0709: Skill in developing analytics
  • S0712: Skill in evaluating data source quality
  • S0713: Skill in evaluating information quality
  • S0718: Skill in identifying cybersecurity threats
  • S0719: Skill in identifying intelligence gaps
  • S0724: Skill in managing client relationships
  • S0728: Skill in preparing briefings
  • S0748: Skill in querying data
  • S0751: Skill in conducting open-source searches
  • S0756: Skill in incorporating feedback
  • S0765: Skill in converting intelligence requirements into intelligence production tasks
  • S0777: Skill in developing collection strategies
  • S0779: Skill in determining information requirements
  • S0791: Skill in presenting to an audience
  • S0869: Skill in performing metadata analysis
  • S0876: Skill in performing nodal analysis