Intelligence
What is TTP?
Tactics, Techniques and Procedures: how an attacker operates, as opposed to the specific artefacts they leave behind.
Tactics, techniques and procedures describe how an adversary operates. Tactics are the goals, such as gaining persistence. Techniques are the general methods, such as creating a scheduled task. Procedures are the specific way a group does it, down to the commands and tools.
TTPs change much more slowly than indicators, which is why detections and profiles built on them last longer. MITRE ATT&CK is the common catalogue used to name them.