TTPs analyze how a malicious actor operates, they describe how cyber attackers orchestrate, execute and manage operational attacks. TTPs contextualize a threat. They reveal the steps or actions taken by malicious actors when exfiltrating data, for example.