TTP(Tactics, Techniques and Procedures)
They describe how attacker thinks, acts and operate during a cyber attack.
If as Indicator Of Compromise(IOC) tells you what happened, TTPs tell you how and why it happened.
SOC analyst use TTPs to:
cyberkashif.hashnode.dev5 min read