How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?

What the interviewer wants to hear

• Focus on intel relevant to your sector, tech stack and threat actors
• IOCs are short-lived; TTPs drive durable detections
• Enrich alerts automatically with intel context
• Use intel to drive hunts and detection gaps
• Score and expire indicators to reduce noise

Model answer

I start with relevance. We care most about actors that target our sector and the technologies we run, so I prioritise reports from our ISAC, vendors and government advisories that match. Raw IOC feeds are useful but noisy and short-lived, so I import them into a platform like MISP with confidence scores and expiry dates, and use them mainly for automatic enrichment of alerts, not as standalone alerts. The bigger value is in TTPs, following the Pyramid of Pain. When a report describes how an actor works, I map it to ATT&CK, check if our detections cover it, and either write new rules or run a hunt. I also feed our own incident findings back as intel, and share sanitised indicators with partners.

More medium Cybersecurity Analyst questions

• Walk me through how you triage a new SIEM or EDR alert.
• You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
• What is MITRE ATT&CK and how do you use it in your work?
• You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
• Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
• How do you write an incident report that works for both technical teams and non-technical leaders?
• A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
• A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
• EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.