Which data collection mechanism provides crucial information about activity related attacks?

• A. Strategic
• B. Operational
• C. Tactical
• D. Technical

Answer: (B)

In threat intelligence, data collection that centers on how attack activity unfolds is best described as operational intelligence. This level gathers details about campaigns, threat actors, and the sequence of events across time—who is involved, what methods they use, when and where activity occurs, and how the attack progresses. That context is crucial for understanding ongoing threats, attributing activity to campaigns, and guiding detection and response as attacks evolve.

Strategic intelligence looks at high-level trends and risks over the long term, not the specifics of current activity. Tactical intelligence focuses on immediate, defender-focused actions and technique-level guidance. Technical intelligence catalogs artifacts like indicators, malware hashes, and infrastructure, which are useful for detection but don’t by themselves convey the full activity of a campaign.