You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/understand-threat-intelligence.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -153,9 +153,11 @@ Establish connections between objects to enhance threat detection and response.
153
153
154
154
| Use case | Description |
155
155
|---|---|
156
-
| Connecting Threat Actor to Attack Pattern | The threat actor "APT29" uses the attack pattern "Phishing via Email" to gain initial access.|
157
-
| Linking Indicator to Threat Actor| An indicator (malicious domain) is attributed to the threat actor "APT29". |
158
-
| Associating Identity (Victim) with Attack Pattern| The organization "Example Corp" is targeted by the attack pattern "Phishing via Email".|
156
+
| Connecting Threat Actor to Attack Pattern | The threat actor *APT29 uses* the attack pattern *Phishing via Email* to gain initial access.|
157
+
| Linking Indicator to Threat Actor| An indicator *allyourbase.contoso.com* domain is attributed to the threat actor *APT29*. |
158
+
| Associating Identity (Victim) with Attack Pattern| The *FourthCoffee* organization is targeted by the attack pattern *Phishing via Email*.|
159
+
160
+
The following image combines all of those connections with the relationship builder.
159
161
160
162
:::image type="content" source="media/understand-threat-intelligence/relationship-example.png" alt-text="Screenshot showing example relationship being built.":::
0 commit comments