Tactical Threat Intelligence is technical and shared as indicators of compromise such as URLs, domains, email addresses, file hashes, and IP addresses.

• A. Continent
• B. Indicators of Compromise (IOCs)
• C. Policies
• D. Usernames

Answer: (B)

Indicators of compromise are the signals security teams use to spot threats. In tactical threat intelligence, the focus is on technical, actionable artifacts that can be shared and used immediately to detect and respond to incidents. These indicators include URLs, domains, email addresses, file hashes, and IP addresses—observed artifacts that appear in logs and security tools and point to malicious activity or a breach. Because they are concrete, observable, and easily disseminated, they enable quick blocking, alerting, and correlation across environments.

Other concepts don’t fit this purpose as directly. A continent is geographic and has no bearing on identifying or tracking intrusions. Policies describe rules and governance, not observable threat signals. Usernames are identifiers for accounts and not the typical observable artifacts used to detect compromise, though compromised accounts can be involved in attacks, they aren’t the primary signals used for rapid detection and sharing in threat intelligence.