Which term describes a platform to manage CTI including actors, campaigns, etc?

• A. Threat Intelligence Platforms (TIPs)
• B. Security Information and Event Management (SIEM)
• C. Incident Response Platform (IRP)
• D. Vulnerability Management System (VMS)

Answer: (A)

Managing cyber threat intelligence (CTI), including threat actors and campaigns, is what a Threat Intelligence Platform is designed to do. A TIP aggregates and organizes CTI from multiple sources, supports analysis and enrichment, and enables sharing and collaboration. It links threat actors to their campaigns, tracks tactics, techniques, and procedures (TTPs), and ties indicators of compromise (IOCs) to contextual threat intel. This makes CTI actionable across teams and over time, with workflows that automate distribution and prioritization of threat information.

In contrast, a SIEM focuses on collecting and correlating internal logs to detect security events; an Incident Response Platform coordinates actions and tasks during active incidents; and a Vulnerability Management System scans for and tracks remediation of vulnerabilities. These functions are centered on internal telemetry, response coordination, or vulnerability handling, rather than the management and orchestration of external CTI including actors and campaigns.