Chapter 21 — Threat intelligence and OSINT: system models
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Intelligence as a system"]
N2["21.2 Bottlenecks"]
N3["21.3 Feedback loops"]
N4["21.4 STIX as a data model"]
N5["21.5 Boundaries"]
N6["21.6 Capacity arithmetic"]
N7["Service levels"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Intelligence as a system"]
N2["21.2 Bottlenecks"]
N3["21.3 Feedback loops"]
N4["21.4 STIX as a data model"]
N5["21.5 Boundaries"]
N6["21.6 Capacity arithmetic"]
N7["Service levels"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Intelligence as a system]
|
v
[21.2 Bottlenecks]
|
v
[21.3 Feedback loops]
|
v
[21.4 STIX as a data model]
|
v
[21.5 Boundaries]
|
v
[21.6 Capacity arithmetic]
|
v
[Service levels]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) model the HCHT intelligence system as inputs, processes and outputs; (2) identify feedback loops; (3) find bottlenecks; (4) express the model in STIX object terms.
21.1 Intelligence as a system
Inputs: HSSC reports, public advisories, vendor feeds, internal incidents. Processes: triage, validation, enrichment, analysis, storage. Outputs: blocks, hunts, briefings, shared reports. Feedback: consumers report what helped. Drawing this flow shows where work piles up.
Amara draws the flow for HCHT on one page and counts what passes through each stage in a typical week. The drawing makes plain that analysis is the narrowest point, which explains why reports often arrive late. It also shows that feedback rarely reaches the start of the flow, so direction is weak, and the team agrees to add a monthly review of what consumers asked for.
21.2 Bottlenecks
At HCHT, analysis is done by one supervisor and one intern. If triage passes every item to analysis, the queue grows faster than it shrinks. A triage rule — only items matching HCHT assets or the sector proceed — keeps the system stable.
Amara tests the rule on a month of past items and finds that about a third would pass, which the team can handle. Items held back are stored and searchable, so nothing is lost if they later become relevant. The rule is reviewed each quarter against what was missed.
21.3 Feedback loops
Positive loop: useful briefings bring more questions, which sharpen direction. Negative loop: too many false-positive blocks make the network team ignore CTI requests. Healthy systems monitor both.
Amara watches for the negative loop by tracking how many blocks were reversed after complaints. When reversals rise, she checks the source of the blocked indicators and tightens the confidence threshold for that source. The positive loop is supported by answering questions quickly and noting in each briefing what the security team asked for and what changed as a result.
21.4 STIX as a data model
STIX 2.1 represents intelligence as objects: indicator, malware, threat-actor, attack-pattern, campaign, identity, report, and relationship objects linking them. Each object has an identifier, timestamps and optional marking definitions such as TLP. Mapping HCHT's database columns to STIX makes later sharing easier.
Amara maps her own columns to STIX properties. Her value column becomes the indicator pattern, first_seen and last_seen become the indicator's validity times, and the TLP column becomes a marking definition. Two columns, status and outcome, have no direct STIX equivalent, so she keeps them as local fields and documents the choice for future analysts.
21.5 Boundaries
The model's boundary excludes clinical decisions; CTI informs them through owners, not directly.
For example, intelligence about attacks on infusion pumps goes to clinical engineering, who decide what changes are safe for patients. The CTI team supplies facts and options, never instructions to clinical staff. Amara draws the boundary on her diagram as a line that intelligence can cross only through a named owner, which reminds the team where its authority ends and where clinical judgment takes over. Recording this boundary prevents well-meant but unsafe recommendations.
21.6 Capacity arithmetic
If forty items arrive per week and each takes thirty minutes to analyse, twenty analyst-hours are needed. Two people with other duties may provide eight. Without triage the backlog grows by about twenty-four items weekly; writing this arithmetic down makes the case for stricter filters or more staff in plain terms.
Amara presents this calculation to the security lead. The lead agrees to the triage rule and asks for a monthly report of the queue, so growth is noticed early. Amara also measures her analysis time per item, which turns out closer to twenty minutes for routine items, and updates the arithmetic.
Service levels
Agree simple targets with consumers: urgent indicators reviewed within four hours, routine items within three working days. Targets turn the system model into commitments and reveal quickly when capacity no longer matches demand.
Worked example
Amara maps a week: 140 items arrived; 40 passed triage; 12 were analysed; 3 led to action. The bottleneck is analysis. She proposes tighter triage criteria and a template that halves write-up time. The supervisor agrees to trial both for a month.
Synthetic case. The counts are invented.
Errors and limits
System diagrams simplify human judgment. Measure before and after changes.
Exercises
- EX061 — Find the bottleneck. In Amara's week, where was the bottleneck and how do you know? Rubric: 3 = analysis; 40 in, 12 done; 2 = analysis; 1 = collection; 0 = none.
- EX062 — Negative loop. Describe a negative feedback loop in CTI delivery. Rubric: 3 = false-positive blocks → network team ignores CTI; 2 = vague; 1 = minimal attempt; 0 = none.
- EX063 — STIX mapping. Which STIX object type links an indicator to a malware object? Rubric: 3 = relationship (e.g. "indicates"); 2 = relationship; 1 = report; 0 = none.
Synthesis
Model CTI as a system, manage bottlenecks, watch feedback loops and map data to STIX.
Continue studying — chapter 21 of 40
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →