Use when tracking a threat actor over time — attributing activity, following their evolving tradecraft, and turning "who and how" into defensive advantage.
