Threat Actor Domain

Overview#

The Threat Actor domain manages threat actor profiles for tracking known malicious entities in intelligence operations. Profiles capture aliases, motivations, tactics, techniques, and procedures (TTPs), sophistication levels, and operational capabilities to support threat assessment and intelligence analysis.

Key Features#

• Threat Actor Profiles - Create and maintain detailed profiles for known threat actors including names, aliases, descriptions, and affiliations to build a comprehensive threat intelligence library.

• TTP Documentation - Document the tactics, techniques, and procedures used by each threat actor to understand their operational methods and predict future behavior.

• Sophistication Assessment - Classify threat actors by sophistication level to understand their technical capabilities and the level of threat they represent.

• Motivation Tracking - Record the motivations behind threat actor activities (financial, espionage, hacktivism, etc.) to support threat prioritization and behavioral analysis.

• Alias Management - Track the various names, handles, and identifiers associated with each threat actor to ensure comprehensive identification across intelligence sources.

• Capability Assessment - Document the known capabilities of threat actors including tools, infrastructure, and resources to inform defensive posture and risk assessment.

• Investigation Linking - Associate threat actor profiles with active investigations to provide intelligence context and track ongoing monitoring of known adversaries.

Use Cases#

• Threat Intelligence Analysis - Build and maintain a library of threat actor profiles to inform security operations, risk assessments, and investigative planning.

• Attribution Support - Compare observed TTPs and indicators against known threat actor profiles to support attribution analysis during incident investigations.

• Threat Prioritization - Assess the sophistication, capabilities, and motivations of threat actors to prioritize defensive measures and investigative resources.

• Intelligence Sharing - Share threat actor profiles with partner organizations to support collaborative threat intelligence and coordinated response efforts.

Integration#

The Threat Actor domain connects with intelligence and investigative capabilities:

• Threat Intelligence - Threat actor profiles enrich IOC analysis and correlation
• Investigation Management - Threat actors link to active investigations
• Profile Management - Threat actor profiles extend the base profile system
• MITRE ATT&CK - TTP documentation maps to standard frameworks

Last Reviewed: 2026-02-05