## Chapter 27 — Threat intelligence and OSINT: verification ### Lesson map Lesson 27 published. Map, example, EX079. ```mermaid flowchart TD N0["Learning outcomes"] N1["27.1 Passive verification"] N2["27.2 Independence"] N3["27.3 Environmental match"] N4["27.4 Internal corroboration"] N5["27.5 Recording"] N6["27.6 Verifying claims, not only indicators"] N7["Time-boxing verification"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 N7 --> EX["Worked example"] EX --> Q["Exercise EX079"] ``` ### Logical drawing ```mermaid flowchart LR N0["Learning outcomes"] N1["27.1 Passive verification"] N2["27.2 Independence"] N3["27.3 Environmental match"] N4["27.4 Internal corroboration"] N5["27.5 Recording"] N6["27.6 Verifying claims, not only indicators"] N7["Time-boxing verification"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX079"] ``` ```text [Learning outcomes] | v [27.1 Passive verification] | v [27.2 Independence] | v [27.3 Environmental match] | v [27.4 Internal corroboration] | v [27.5 Recording] | v [27.6 Verifying claims, not only indicators] | v [Time-boxing verification] | v [Worked example] --> [Exercise EX079] ``` ### Learning outcomes You will (1) verify indicators passively before action; (2) corroborate claims with independent sources; (3) check whether intelligence matches HCHT's environment; (4) record verification steps. ### 27.1 Passive verification Check indicators without touching adversary systems: public DNS records, certificate-transparency logs, registration data where available, and reputable public reputation services. Visiting a live phishing page from a work device is not passive and is not allowed. Amara keeps a list of approved passive sources and checks each indicator against them in the same order, recording what each returned. If a check would require visiting the site, she stops and asks whether an isolated analysis environment is available. Most indicators can be judged well enough without it, and the record shows how each conclusion was reached. ### 27.2 Independence Two reports are independent only if they rest on different observations. Ask each source what its claim is based on. Citations to the same vendor blog do not corroborate each other. Amara asks HSSC members to state whether a report comes from their own observation or repeats another source. Two members who saw the same phishing messages in their own mail gateways count as independent; two who both cite one vendor blog do not. The distinction is recorded in the item's provenance so it is not lost when the item is shared again. ### 27.3 Environmental match An advisory about a product HCHT does not run is lower priority, however severe. Check the inventory, versions and exposure. Amara checks every advisory against the inventory before analysing it further. If HCHT runs the product, she notes the versions and whether the affected system is reachable from the internet. If not, the advisory is logged as not applicable with the date of the check, so it can be revisited if the inventory changes. This simple step removes most advisories from the analysis queue within minutes. ### 27.4 Internal corroboration The best verification is often internal: did HCHT's mail gateway receive messages from the reported sender? Did any device contact the domain? Internal sightings both verify and measure relevance. Amara runs these searches for every domain and sender in HSSC reports that pass triage. A sighting raises credibility and makes the item urgent for HCHT; no sighting, given good log coverage, lowers its priority. She records the time range and log sources searched, since a clean result means little if the logs did not cover the relevant period. ### 27.5 Recording A verification record lists each check, its result, the time and the analyst. Others can repeat or challenge it. Amara's records are short: one line per check with the source, result and time. They are stored with the item in the database, so verification and grading sit together. When a reviewer questioned one of her grades, the record showed exactly what had been checked and when, and the grade was confirmed without repeating the work. Records also show which checks find most problems. ### 27.6 Verifying claims, not only indicators Narrative claims need checking too: "the group always demands payment within 48 hours" may come from one case. Trace the claim to its original source, see what evidence it cited and whether later reporting confirmed it. Unverified claims stay in the report only with a clear caveat. Amara traced that claim to a single vendor report. The report described one case, and later reporting showed other cases with longer deadlines. Amara rewrites the sentence in her draft to say that one case involved a 48-hour demand, citing the source, and removes the word "always". Narrative claims spread easily, so each one in her reports carries its source. ### Time-boxing verification Verification can expand forever. Set a time box proportional to urgency: fifteen minutes for a domain already seen in HCHT mail, longer for a strategic claim. When the box expires, report what was verified and what was not, so decision-makers are not kept waiting for certainty that may never come. ### Worked example HSSC shares a domain tagged as phishing. Amara checks certificate-transparency logs (certificate issued yesterday), public DNS (resolves to a hosting provider), and HCHT mail logs (four messages yesterday to finance staff). Internal sightings confirm relevance; she escalates for blocking and user notification. > **Synthetic case.** The domain and messages are invented. ### Errors and limits Passive checks can mislead: new certificates are normal. Weight internal evidence highly. ### Exercises - **EX079 — Not passive.** Why is visiting a live phishing page from a work laptop not passive verification? *Rubric:* 3 = contacts adversary infrastructure; can alert/expose/infect; policy breach; 2 = partial; 1 = it is fine; 0 = none. - **EX080 — Independence test.** What question establishes whether two reports are independent? *Rubric:* 3 = what each is based on—different observations?; 2 = partial; 1 = same date?; 0 = none. - **EX081 — Best evidence.** Which check gave Amara the strongest reason to escalate? *Rubric:* 3 = internal mail logs showing four messages to finance; 2 = mail logs; 1 = certificate; 0 = none. ### Synthesis Verify passively, demand independence, match to the environment, prize internal sightings and record every check. ### Continue studying — chapter 27 of 40 [← Chapter 26 (draft)](#ch-26) · [Course chapter index](../SUBJECTS.md) · [Chapter 28 (draft) →](#ch-28) ## Worked answers **EX079.** It makes contact with adversary infrastructure, which can reveal HCHT's interest, expose the device and breaks policy. **EX080.** Ask what observation each report is based on; only reports resting on different observations are independent. **EX081.** HCHT's own mail logs showing four messages to finance staff — direct evidence of relevance.