CySA+ Threat Intelligence: Indicators, Tactics, and Confidence in a Finding

What is the difference between an indicator, behavior, and tactic?

CompTIA's CS0-004 objectives include atomic and behavioral indicators, threat actor tactics, techniques and procedures, and the timeliness, relevance and accuracy of intelligence. A defensible threat-intelligence conclusion connects an observation to supporting context, explains the uncertainty, and identifies the next evidence needed.

This guide follows the CS0-004 V4 objectives, document version 2.0, checked November 3, 2026. Use the CySA+ objectives guide to place threat intelligence within your exam scope, then practice separating three questions:

• Indicator: what matched? An IP address in a local record matches an address in a threat report. That gives you a specific lead to investigate.
• Behavior: what happened? A sequence of records shows an account accessing files and a host making an outbound connection. Describe those observations before deciding whether they are malicious.
• Tactic: what goal might explain the activity? MITRE defines an ATT&CK tactic as an adversary's goal. Stealing data suggests an Exfiltration hypothesis, but a connection alone does not establish that data was stolen.

The distinction matters when an exercise asks for the best conclusion. A precise identifier, a sequence of actions and an inferred goal answer different questions. Before choosing a response, write down which of the three the available evidence actually supports.

How do freshness, relevance and accuracy change confidence?

Objective 1.4 names timeliness, relevance and accuracy as intelligence-quality considerations. Apply them to a report before using its conclusion in your own analysis:

1. Timeliness: when was the activity observed, and when was the report updated? A recently published report can still describe older activity. Record both dates if they are available.
2. Relevance: what part of the report matches your environment or evidence? A matching address is one connection; matching behavior and affected assets may add context. State the actual overlap.
3. Accuracy: what evidence supports the report's assertion, and can you check it? Separate a reported conclusion from the observations behind it. Mark missing support instead of silently treating it as confirmed.

These are editorial prompts for applying the objectives, not a CompTIA scoring formula. Avoid assigning an invented percentage to confidence. A statement such as “the local connection is confirmed, but its purpose remains unknown” explains more than “high confidence” without a reason.

For practice, full CompTIA CySA+ prep planned for launch includes 1,350 questions across four domains. Use each intelligence scenario to explain why a source is useful and what it still cannot establish.

What can an ATT&CK tactic explain about the goal?

MITRE's Enterprise tactics page, checked November 3, 2026, organizes tactics around attacker goals. For example, Credential Access concerns stealing credentials, Discovery concerns learning about the environment, and Lateral Movement concerns moving through it. Those labels help organize an explanation once you have described the evidence.

Ask “what goal would this activity serve?” and then ask “what evidence supports that interpretation?” In a synthetic exercise, a record of an account reading a directory does not, on its own, establish that an attacker is conducting Discovery. You would still need context about the account, activity and authorized work.

You can also leave a mapping unresolved. If the supplied facts show an outbound connection but no transferred content, write that Exfiltration is a possibility requiring further evidence. Do not turn a useful framework label into proof.

CompTIA names ATT&CK under objective 3.1. A changing live framework is not a reason to assume the exam has adopted every website revision. Study the relationship between evidence and goals rather than treating a fixed tactic count as your readiness test. Start with the 20 free CySA+ practice questions and identify which facts support each conclusion you make.

Which evidence would support or weaken an original hypothesis?

Consider this original, synthetic practice case. It is not a recalled exam question or a claim about a real incident:

• A local network record shows workstation W-17 connecting to destination D.
• A threat report associates D with previously observed malicious activity.
• A local file-access record shows account A reading a sensitive document on W-17 shortly before the connection.
• The exercise supplies neither the transferred content nor confirmation that these events share a cause.

A reasonable initial hypothesis is possible unauthorized data transfer. It is not yet a confirmed exfiltration finding. Close timestamps and a reputation match justify investigation, but the case has not established what moved, why it moved or who initiated it.

Work through two branches. Evidence connecting the sensitive document to the outbound transfer would strengthen the hypothesis. Evidence that the connection belonged to an approved workflow would weaken that interpretation, although you would still check whether the file access was authorized. If the exercise supplies neither, keep both the concern and the uncertainty visible.

Choose a collection step that resolves a specific gap: inspect available permitted transfer records to establish content, correlate endpoint evidence to establish the initiating activity, or check the responsible owner's authorization record. Do not collect more data without saying what question it should answer.

NIST SP 800-61 Revision 3 emphasizes reconstructing events and preserving evidence integrity and provenance. Keep the original records and record your investigative actions. The CySA+ log-analysis guide provides more practice separating observations from inferences.

For terminology review between cases, full CompTIA CySA+ prep planned for launch includes 500 flashcards. Pair each term with a sentence explaining the evidence you would need before applying it.

Why does one indicator not prove an attacker identity?

In the synthetic case, the threat report links destination D to past activity. The local record establishes a connection to D. Neither observation identifies the person or group responsible for the current connection.

Keep those claims separate in your notes: “the report associates this destination with malicious activity” is different from “this named actor compromised W-17.” The second claim needs supporting attribution evidence that the exercise has not supplied. Do not fill that gap with a familiar group name or a tactic label.

Before reporting a conclusion, underline every statement about identity, intent and impact. For each, point to the supporting evidence or mark it as unresolved. That check connects objective 1.4's intelligence concepts with the framework coverage in objective 3.1.

How should you communicate confidence and the next collection step?

Use a short finding with four parts: observation, interpretation, limitation and next action. For the synthetic case, an editorial example is:

W-17 connected to a destination associated with malicious activity in the supplied report. Nearby sensitive-file access raises concern about unauthorized transfer. The provided records do not establish transferred content, a causal link or attacker identity. Review permitted transfer and endpoint records, and confirm authorization with the responsible owner, to resolve those gaps.

NIST distinguishes information sharing from incident coordination and notification. Follow established procedures for the recipient and content of a finding; a study exercise does not establish permission to share sensitive records or take response actions. Use the CySA+ incident-response guide when the task moves from interpreting evidence to choosing a response.

Put one original evidence-to-conclusion exercise into the free CySA+ study plan. Finish when you can explain both what supports your hypothesis and what would change your mind. To broaden that work across the exam, full CompTIA CySA+ prep planned for launch covers Security Operations, Vulnerability Management, Incident Response and Management, and Reporting and Communication.