SANS Advanced Incident Response, Threat Hunting, and Digital Forensics (FOR508) Practice test

These tools are threat intelligence platforms focused on handling indicators of compromise. They provide a structured way to collect, store, enrich, and share IOCs (like malicious IPs, domains, file hashes, and TTPs) across teams or communities. By organizing indicators, tagging relationships, and enabling collaboration, they support detection, response, and threat hunting workflows. They aren’t antivirus engines, firewalls, or data loss prevention products, which is why those other options don’t fit.