A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.