◇ OpenCyber Academy
Bachelor's · Chapter 25 · English

Chapter 25 — Threat intelligence and OSINT: Laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Threat intelligence and OSINT: Laboratory I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Lab design"]
  N2["25.2 Environment rules"]
  N3["25.3 Steps"]
  N4["25.4 The lab report"]
  N5["25.5 Assessment"]
  N6["25.6 Reproducibility"]
  N7["25.7 Pairing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Lab design"]
  N2["25.2 Environment rules"]
  N3["25.3 Steps"]
  N4["25.4 The lab report"]
  N5["25.5 Assessment"]
  N6["25.6 Reproducibility"]
  N7["25.7 Pairing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Lab design]
    |
    v
[25.2 Environment rules]
    |
    v
[25.3 Steps]
    |
    v
[25.4 The lab report]
    |
    v
[25.5 Assessment]
    |
    v
[25.6 Reproducibility]
    |
    v
[25.7 Pairing]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) run an end-to-end mini pipeline on synthetic data; (2) combine validation, storage and redaction; (3) write a lab report; (4) reflect on lab safety and data rules.

25.1 Lab design

This laboratory combines earlier labs into one exercise. Students receive a synthetic HSSC CSV feed, validate it (chapter 8), load accepted rows into SQLite (chapter 9), redact a synthetic phishing sample (chapter 14) and produce a one-page shareable summary filtered to TLP:CLEAR and TLP:GREEN.

The point of combining them is to see how errors carry through: a row accepted by mistake at validation can end up in the shareable summary. Students trace at least one item from the raw feed to the final page and explain each decision made along the way, which is what an analyst at HCHT must be able to do for any indicator that leaves the trust.

25.2 Environment rules

Work only in the course virtual machine with no internet route. Use standard-library Python. Do not paste real HCHT data or real indicators from work into the lab. If a lab file seems to contain real personal data, stop and tell the instructor.

These rules mirror HCHT's own: work stays in an approved environment, uses approved tools and never mixes coursework with real intelligence. The isolated machine also means a mistake, such as a script that tries to fetch a domain, cannot reach the internet or alert anyone.

25.3 Steps

First, run validation and note rejections with reasons. Second, load accepted rows and query by type and label. Third, redact the sample and confirm the adversary address survives. Fourth, write the summary: what was received, what was rejected, what may be shared and with whom.

Students record the output of each step before moving on, so a problem can be traced to where it began. The summary is written last and must agree with the counts from the earlier steps.

25.4 The lab report

A lab report has aim, method, results, problems and reflections. Results include exact counts and script outputs; problems include anything that surprised you. Reflection asks what would change with real data.

Amara's own report notes that one rejected row would have been accepted if she had trusted the spreadsheet view, which shows why the validation step matters. Reflections should be specific: what would break with a larger feed, a new column or a different TLP mix, and what she would change first.

25.5 Assessment

Marks reward correct outputs, clear reasoning, honest problems and correct handling labels. Pretty formatting earns nothing extra.

A correct output with no explanation earns little, because the course is teaching judgment as much as scripting. Honest reporting of problems, including a step that did not work, earns credit; hiding it loses more than the problem itself. Mislabelled TLP in the summary is treated as a serious error, since in practice it would breach a sharing agreement. Feedback explains each mark, so students can improve the next report.

25.6 Reproducibility

A classmate should be able to repeat your work from the report alone. Record script versions, input file names, the order of steps and any manual edits. If you corrected a value by hand, say so; hidden manual fixes make results impossible to reproduce.

Students test this by swapping reports and trying to reproduce each other's counts. Where counts differ, the pair works out whether the report or the script was unclear, and the report is corrected. Amara's first report missed the order in which she ran two queries, which changed one count; the classmate's attempt revealed it.

25.7 Pairing

Students work in pairs: one runs the scripts, the other checks outputs against expectations and records discrepancies. Roles swap halfway. Pairing catches mistakes early and practises the review habit that real teams rely on.

The checker writes down what each output should be before the script runs, so the comparison is a real test rather than agreement after the fact. Discrepancies are listed in the lab report with how they were resolved. Pairs also agree beforehand how to record a disagreement, so that neither simply defers to the other.

Worked example

Amara's pair finds that the summary includes a row labelled TLP:AMBER because the filter compared labels case-sensitively and the row said "tlp:amber". They normalise labels to upper case at import, rerun, and note the bug in their report's problems section.

Synthetic case. The feed and bug are invented teaching material.

Errors and limits

A lab proves the pipeline on clean synthetic data; real feeds are messier.

Exercises

Synthesis

Combine the pieces, follow lab rules, report honestly and make your work reproducible.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →