Certified Incident Handler (CIH) Practice Ecam

During which phase of the threat-hunting process would a security analyst analyze past events using threat intelligence?

1. Collect and process the data

2. Investigation

3. Response/resolution

4. Hypothesis

The correct answer is: Collect and process the data

The correct phase during which a security analyst analyzes past events using threat intelligence is during the data collection and processing phase. This stage is crucial as it involves gathering relevant data sources and employing threat intelligence to identify patterns or anomalies in the data. By analyzing historical events and correlating them with threat intelligence, analysts can better understand the context of the threats facing their organization. Threat intelligence plays a pivotal role in refining data collection, allowing analysts to focus on specific types of events that have been identified as potential security risks. This approach enables a more targeted investigation in subsequent phases. Consequently, the insights gained from analyzing past events serve to form the basis for hypotheses and subsequent investigative efforts.