Mile2 C)TIA cheat sheet

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.

Intelligence cycle phases in order: requirements/planning, collection, processing, analysis and production, dissemination, feedback - analysis converts raw data into assessed meaning; feedback restarts the cycle.

Data, information, and intelligence are distinct: data is raw observation, information is data with context, intelligence is information analyzed against requirements to support a specific decision.

Analytic confidence and likelihood are separate judgments: confidence describes source and analytic reliability, likelihood describes probability of an event; state them independently.

Structured Analytic Techniques (SATs) counter cognitive bias: ACH scores competing hypotheses against evidence, key assumptions check surfaces unstated premises, devil's advocacy challenges consensus.

Analysis of Competing Hypotheses (ACH) works by seeking evidence that disproves hypotheses, not evidence that confirms them; the hypothesis with the least inconsistent evidence is favored.

The Diamond Model has four vertices - adversary, capability, infrastructure, victim - linked by social-political and technical relationships, with meta-features recording timestamps, phase, and result.

The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping intrusion activity to stages shows where to disrupt.

Attribution is probabilistic, not binary: weigh tradecraft, infrastructure reuse, malware code overlap, language artifacts, and operational tempo; false flags deliberately mimic another actor's indicators.

MITRE ATT&CK organizes adversary behavior by tactic (why) and technique (how); TTPs are more durable than atomic IOCs, so detection engineering prioritizes behavior over hashes and IPs.

Source tiers: strategic (policy, geopolitical, industry reporting), operational (campaign and actor reporting), tactical (TTPs), technical (IOCs such as hashes, domains, IPs, YARA rules).

Source types: OSINT (public), SIGINT (signals), HUMINT (human), GEOINT (imagery), MASINT (measurement signatures), and TECHINT; open and closed sources carry different collection constraints.

The Admiralty source reliability scale runs A (completely reliable) to F (cannot be judged); information credibility runs 1 (confirmed) to 6 (cannot be judged) - combine as A1, B2, etc.

Indicator confidence decays with time: IP addresses and domains rotate faster than malware families or TTPs; assign a decay or TTL to each indicator type before sharing.

STIX 2.x is the structured language for cyber threat data - SDOs (indicator, malware, threat-actor, campaign), SROs (relationship, sighting), and SCOs (IP address, file, domain-name).

TAXII is the transport protocol for exchanging STIX over HTTPS; TAXII 2.x uses collections and channels, while TAXII 1.x used services and subscriptions.

Collection planning starts from intelligence requirements (PIRs/SIRs), not from available feeds; a feed that does not map to a requirement adds noise and cost.

Indicator hygiene checks before ingestion: deduplicate, whitelist known-good (CDN, public resolver, vendor) values, validate format, and confirm first/last seen dates.

Open-source feed examples include AlienVault OTX, abuse.ch (URLhaus, MalwareBazaar), CISA AIS, and MISP communities; commercial feeds add curation but still need local validation.

A TIP aggregates, normalizes, deduplicates, and scores indicators, then distributes them to enforcement points such as SIEM, firewall, proxy, EDR, and DNS sinkholes.

MISP (Malware Information Sharing Platform) organizes events containing attributes, objects, galaxies, and tags; sharing groups and distribution levels control who receives data.

OpenCTI models entities and relationships in a graph database (Elasticsearch plus a graph backend) built on STIX 2.1; connectors ingest feeds and enrich observables.

TheHive is a case-management tool and Cortex is its analyzer/responder engine; together they automate enrichment of observables pulled from alerts.

TIP-to-SIEM integration is typically API-based (STIX/TAXII or REST); watch for indicator volume exceeding SIEM lookup limits and for mismatch in indicator formats.

Enrichment sources include WHOIS/RDAP, passive DNS, VirusTotal, Shodan, GreyNoise, and sandboxes (Cuckoo, CAPE); enrichment adds context but each lookup may leak the indicator to a third party.

YARA matches static file content by rule (strings plus condition), Sigma matches log events in SIEM-agnostic form, and Snort/Suricata rules match network traffic.

Threat intelligence platforms must support indicator aging and revocation; stale indicators left in blocklists cause false positives and operational outages.

Feed scoring models weigh source reliability, indicator age, corroboration across sources, and prior true-positive rate; scores drive automatic block, alert, or log-only actions.

Intelligence requirements drive tasking: PIRs (priority intelligence requirements) define what decision makers need, and each product must trace back to one.

Product types: tactical (IOCs, detection rules), operational (campaign and actor profiles), strategic (trend, risk, and geopolitical assessments for leadership).

The BLUF (bottom line up front) structure puts the key judgment first, then supporting evidence, then confidence and source notes.

Words of estimative probability standardize language: almost certain (~95%), likely (~70-80%), roughly even chance (~50%), unlikely (~20-30%), remote (~5%).

Dissemination must respect sharing rules: TLP 2.0 levels are RED (named recipients only), AMBER (organization plus clients), GREEN (community), CLEAR (public).

Feedback metrics for a threat intel program: percentage of indicators that fired true positives, mean time from indicator receipt to detection deployment, and products consumed per requirement.

Legal and privacy constraints apply to collection: GDPR and similar regimes limit personal data, and handling rules govern classified or vendor-licensed feeds.

Operational security for the intel team: analyst infrastructure should be segregated, and indicators should be queried via proxies so adversaries cannot map the defender's interest.

Reporting cadence commonly separates daily tactical briefs, weekly operational summaries, and quarterly strategic assessments aligned to decision cycles.