Protection and Defense · PD-WRL-006 · OPM code 141
Threat Analysis
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for collecting, processing, analyzing, and disseminating cybersecurity threat assessments. Develops cybersecurity indicators to maintain awareness of the status of the highly dynamic operating environment.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0569 Answer requests for information
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0685 Evaluate threat decision-making processes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0698 Facilitate continuously updated intelligence, surveillance, and visualization input to common operational picture managers
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0707 Generate requests for information
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0718 Identify intelligence gaps and shortfalls
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0751 Monitor open source websites for hostile content directed towards organizational or partner interests
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0845 Identify cyber threat tactics and methodologies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1020 Determine the operational and safety impacts of cybersecurity lapses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1035 Determine how threat activity groups employ encryption to support their operations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1053 Identify and characterize intrusion activities against a victim or target
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1054 Scope analysis reports to various audiences that accounts for data sharing classification restrictions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1055 Determine if priority information requirements are satisfied
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1640 Determine effectiveness of intelligence collection operations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1641 Recommend adjustments to intelligence collection strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1643 Develop common operational pictures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1644 Develop cyber operations indicators
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1645 Coordinate all-source collection activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1646 Validate all-source collection requirements and plans
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1647 Develop priority information requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1651 Prepare threat and target briefings
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1652 Prepare threat and target situational updates
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1686 Identify intelligence requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1762 Modify collection requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1763 Determine effectiveness of collection requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1765 Monitor changes to designated cyber operations warning problem sets
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1766 Prepare change reports for designated cyber operations warning problem sets
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1767 Monitor threat activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1768 Prepare threat activity reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1770 Report on adversarial activities that fulfill priority information requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1772 Identify indications and warnings of target communication changes or processing failures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1775 Prepare cyber operations intelligence reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1776 Prepare indications and warnings intelligence reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1792 Assess effectiveness of intelligence production
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1793 Assess effectiveness of intelligence reporting
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1798 Provide intelligence analysis and support
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1799 Notify appropriate personnel of imminent hostile intentions or activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1804 Prepare network intrusion reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1835 Determine if intelligence requirements and collection plans are accurate and up-to-date
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0480Knowledge of malware
- K0655Knowledge of intelligence fusion
- K0658Knowledge of cognitive biases
- K0674Knowledge of computer networking protocols
- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0689Knowledge of network infrastructure principles and practices
- K0690Knowledge of requirements analysis principles and practices
- K0697Knowledge of encryption algorithm capabilities and applications
- K0718Knowledge of network communications principles and practices
- K0719Knowledge of human-computer interaction (HCI) principles and practices
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0766Knowledge of data asset management principles and practices
- K0773Knowledge of telecommunications principles and practices
- K0786Knowledge of physical computer components
- K0787Knowledge of computer peripherals
- K0788Knowledge of adversarial tactics principles and practices
- K0789Knowledge of adversarial tactics tools and techniques
- K0790Knowledge of adversarial tactics policies and procedures
- K0792Knowledge of network configurations
- K0806Knowledge of machine virtualization tools and techniques
- K0812Knowledge of digital communication systems and software
- K0818Knowledge of new and emerging cybersecurity risks
- K0825Knowledge of threat vector characteristics
- K0831Knowledge of network attack vectors
- K0844Knowledge of cyber attack stages
- K0845Knowledge of cyber intrusion activity phases
- K0857Knowledge of malware analysis tools and techniques
- K0858Knowledge of virtual machine detection tools and techniques
- K0865Knowledge of data classification standards and best practices
- K0866Knowledge of data classification tools and techniques
- K0915Knowledge of network architecture principles and practices
- K0916Knowledge of malware analysis principles and practices
- K0925Knowledge of wireless communication tools and techniques
- K0926Knowledge of signal jamming tools and techniques
- K0934Knowledge of data classification policies and procedures
- K0960Knowledge of content management system (CMS) capabilities and applications
- K0969Knowledge of cyber-attack tools and techniques
- K0983Knowledge of computer networking principles and practices
- K0984Knowledge of web security principles and practices
- K0989Knowledge of intelligence information repositories
- K0990Knowledge of cyber operations principles and practices
- K0994Knowledge of denial and deception tools and techniques
- K1002Knowledge of supervisory control and data acquisition (SCADA) systems and software
- K1005Knowledge of intelligence collection capabilities and applications
- K1007Knowledge of intelligence requirements tasking systems and software
- K1008Knowledge of intelligence support activities
- K1009Knowledge of threat intelligence principles and practices
- K1010Knowledge of intelligence policies and procedures
- K1011Knowledge of network addressing principles and practices
- K1014Knowledge of network security principles and practices
- K1019Knowledge of operations security (OPSEC) principles and practices
- K1025Knowledge of decision-making policies and procedures
- K1028Knowledge of target development principles and practices
- K1035Knowledge of target research tools and techniques
- K1049Knowledge of routing protocols
- K1059Knowledge of request for information processes
- K1066Knowledge of threat behaviors
- K1067Knowledge of target behaviors
- K1068Knowledge of threat systems and software
- K1069Knowledge of virtual machine tools and technologies
- K1100Knowledge of analytical tools and techniques
- K1101Knowledge of analytics
- K1109Knowledge of virtual collaborative workspace tools and techniques
- K1113Knowledge of blue force tracking
- K1197Knowledge of priority intelligence requirements
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0111Skill in interfacing with customers
- S0194Skill in conducting non-attributable research
- S0385Skill in communicating complex concepts
- S0430Skill in collaborating with others
- S0433Skill in creating analytics
- S0434Skill in extrapolating from incomplete data sets
- S0435Skill in analyzing large data sets
- S0436Skill in creating target intelligence products
- S0438Skill in functioning effectively in a dynamic, fast-paced environment
- S0443Skill in mitigating cognitive biases
- S0444Skill in mitigating deception in reporting and analysis
- S0446Skill in mimicking threat actors
- S0472Skill in developing virtual machines
- S0473Skill in maintaining virtual machines
- S0494Skill in performing operational environment analysis
- S0505Skill in performing intrusion data analysis
- S0506Skill in identifying customer information needs
- S0509Skill in evaluating security products
- S0511Skill in establishing priorities
- S0512Skill in extracting metadata
- S0514Skill in preparing operational environments
- S0516Skill in performing threat emulation tactics
- S0517Skill in anticipating threats
- S0535Skill in performing threat factor analysis
- S0537Skill in designing wireless communications systems
- S0540Skill in identifying network threats
- S0555Skill in performing capabilities analysis
- S0556Skill in performing requirements analysis
- S0579Skill in preparing reports
- S0600Skill in collecting relevant data from a variety of sources
- S0633Skill in developing position qualification requirements
- S0673Skill in translating operational requirements into security controls
- S0696Skill in conducting deep web research
- S0702Skill in defining an operational environment
- S0704Skill in performing target analysis
- S0709Skill in developing analytics
- S0712Skill in evaluating data source quality
- S0713Skill in evaluating information quality
- S0718Skill in identifying cybersecurity threats
- S0719Skill in identifying intelligence gaps
- S0724Skill in managing client relationships
- S0728Skill in preparing briefings
- S0748Skill in querying data
- S0751Skill in conducting open-source searches
- S0756Skill in incorporating feedback
- S0765Skill in converting intelligence requirements into intelligence production tasks
- S0777Skill in developing collection strategies
- S0779Skill in determining information requirements
- S0791Skill in presenting to an audience
- S0869Skill in performing metadata analysis
- S0876Skill in performing nodal analysis
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Information Security Analysts 15-1212.00DWAs covered10 of 10
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00
- Fraud Examiners, Investigators and Analysts 13-2099.04
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)No published DCWF equivalent.