CTSP cheat sheet

Intelligence cycle: direction/planning, collection, processing, analysis, dissemination, feedback; each phase gates the next.

Data vs information vs intelligence: raw observations become information when contextualized, intelligence when analyzed for a decision.

Pyramid of Pain ranks indicator value: hashes/IPs/domains (trivial to change) < network/host artifacts < TTPs (hardest for adversary to change).

Levels: strategic (risk, intent, resourcing), operational (campaigns, infrastructure), tactical (TTPs), technical (IOCs).

F3EAD loop: Find, Fix, Finish, Exploit, Analyze, Disseminate - action-oriented cycle used for active operations.

Confidence vs likelihood: analytic confidence describes source/evidence strength; likelihood describes probability of an event.

Diamond Model nodes: adversary, capability, infrastructure, victim; pivoting across edges yields campaign correlation.

CTI is decision support tied to a requirement; collection without a stated intelligence requirement produces unusable volume.

Actor taxonomy: nation-state/APT, organized crime, hacktivist, insider, commodity/initial-access broker; motivation drives targeting.

Nation-state actors prioritize espionage and pre-positioning over monetization; dwell time and stealth exceed commodity crime.

Ransomware ecosystem roles: initial access brokers, affiliates/operators, developers, negotiators, and leak-site operators.

MITRE ATT&CK Enterprise tactics are ordered by adversary goal (recon through impact); techniques are sub-IDs like T1059.001.

Commodity vs targeted: commodity campaigns reuse public tooling and broad phishing; targeted campaigns tailor lures and infrastructure.

Sector targeting correlates with data value and regulation: finance, healthcare, government, and critical infrastructure face distinct pressures.

Actor attribution is probabilistic; track aliases across vendors because naming conventions differ and are not standardized.

Threat landscape reporting requires time-bounded scope: state the observation window and note that absence of reports is not absence of activity.

Source classes: OSINT, HUMINT, SIGINT, technical (telemetry, honeypots, sandboxes), commercial feeds, and closed forums.

Collection plan maps each intelligence requirement to named sources, method, frequency, owner, and confidence threshold.

PIRs (priority intelligence requirements) drive collection; SIRs/EEIs decompose them into observable events and indicators.

Source evaluation uses Admiralty code: reliability A-F for source, 1-6 for information credibility; report both letters.

Technical collection tradecraft: passive (netflow, DNS logs, honeypots) vs active (scanning, sinkholes) - active collection carries OPSEC and legal exposure.

Feed hygiene: deduplicate, normalize timestamps to UTC, record first/last seen, and track provenance for every observable.

Collection gaps must be documented explicitly; unstated gaps become false analytic confidence downstream.

Legal/ethical limits apply to collection: no unauthorized access, respect platform terms, and consider privacy and jurisdiction.

SATs counter cognitive bias: ACH, key assumptions check, devil's advocacy, red teaming, what-if analysis, and premortem.

Analysis of Competing Hypotheses (ACH): list hypotheses, score evidence consistency/inconsistency per hypothesis, reject by most inconsistency rather than confirming one.

Key Assumptions Check: surface and test the unstated premises the analytic line depends on; record which are unverified.

Indicators/signposts: define observable events that would confirm or disconfirm each hypothesis before new reporting arrives.

Confidence language must be calibrated: distinguish 'likely' probability bands from analytic confidence in the judgment itself.

Bias inventory: confirmation bias, anchoring, availability, mirror-imaging, and groupthink are the common failure modes in CTI.

Structured writing: BLUF (bottom line up front), then key judgments, then evidence and confidence, then gaps.

Devil's advocacy/red teaming: assign an analyst to argue the alternative hypothesis to stress-test the primary judgment.

IOC types: file hashes (MD5/SHA-1/SHA-256), IPs, domains, URLs, email artifacts, registry keys, mutexes, and JA3/JA3S fingerprints.

Indicator lifecycle: aging and decay matter; re-verify IOCs before blocking because infrastructure is repurposed and sinkholed.

Detection vs indicator: TTP-based detections (behavioral) survive infrastructure rotation better than atomic IOCs.

Hunting loop: hypothesis from intel or ATT&CK gap, query telemetry, triage hits, confirm/deny, convert confirmed findings into detections.

Hunt hypotheses must be falsifiable and scoped: define data sources, time window, and expected observable before querying.

Pivoting: from IOC to infrastructure (WHOIS, passive DNS, certificate transparency) and from infrastructure to related samples.

False positive control: baseline normal behavior per environment; indicator matches without context are leads, not confirmations.

Sigma/YARA/AQL/KQL: rule formats differ by platform; YARA matches file content, Sigma describes log detections portably.

TIP core functions: ingest/normalize feeds, deduplicate, store observables with provenance, enrich, score, and distribute to controls.

STIX 2.1 defines objects (indicator, malware, threat-actor, campaign, relationship, sighting) and is transported via TAXII.

TAXII 2.1 provides collection endpoints over HTTPS with channels; it is a transport protocol, not a data model.

MISP: open-source sharing platform with events, attributes, galaxies, and taxonomies; supports feeds and sharing groups.

OpenCTI: graph-based platform built on STIX 2.1 with connectors for feeds and enrichment.

Enrichment sources: VirusTotal, PassiveTotal, Shodan, WHOIS/RDAP, passive DNS, sandbox reports; enrichment adds context, not truth.

Integration targets: SIEM, EDR, firewall/proxy blocklists, SOAR playbooks; TIP output must be machine-consumable and versioned.

Scoring and false-positive control: apply confidence, TTL, and allowlists before automated blocking to prevent operational disruption.

Audience mapping: executives need risk and decisions; SOC needs observables and detection logic; hunt teams need TTPs and hypotheses.

BLUF structure: bottom line, key judgments with confidence, evidence, implications, recommended actions, and gaps.

Estimate language must be explicit: define probability terms (e.g., 'likely' = 55-80%) in the report or reference a stated scale.

Tearlines: separate machine-readable observables (CSV/STIX) from narrative so consumers can ingest without parsing prose.

Handling markings (TLP 2.0: CLEAR, GREEN, AMBER, AMBER+STRICT, RED) define sharing scope and must travel with the content.

Timeliness vs completeness: urgent indicators go out early with a confidence caveat; the full report follows.

Feedback loop: measure whether the report changed a decision or detection; track consumer requests and unanswered requirements.

Avoid vendor-lock language: state source provenance and confidence so consumers can independently weigh the judgment.

OPSEC for analysts: separate research identities from personal accounts, use isolated VMs, and never attribute from a personal IP.

Collection legality: unauthorized access to systems violates CFAA-type laws; scraping must respect platform terms and local law.

GDPR/privacy: personal data in IOCs (emails, names) requires lawful basis, minimization, retention limits, and handling controls.

Data handling: classify by TLP and contractual terms; commercial feed licenses often forbid redistribution to third parties.

Chain of custody: preserve hashes, timestamps, and collection notes for any artifact that may support legal or HR action.

Attribution and disclosure ethics: avoid naming individuals without evidence; coordinate vulnerability disclosure with vendors before publication.

Insider threat handling: involve legal/HR early; monitoring must follow stated policy and employment law in the jurisdiction.

Incident legal triggers: breach notification timelines, law-enforcement engagement, and regulator reporting vary by jurisdiction and sector.