How to Apply Threat Intelligence Models to Cyber Investigations by Renaud Leroy

This Vectra case study describes how AI-driven intrusion analytics and enriched metadata enable real-time detection and investigation of network intrusions, illustrating correlated detections that produced a high-priority quadrant score, identification of a C2 domain (rotation.craigconnors.com communicating on port 8080), a Kerberoasting privilege-anomaly tied to lateral movement, and the use of the kill chain and Diamond models to contextualize attacker TTPs and guide response.