◇ OpenCyber Academy
Bachelor's · Chapter 29 · English

Chapter 29 — Threat intelligence and OSINT: operations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 29 — Threat intelligence and OSINT: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Weekly rhythm"]
  N2["29.2 Requirements"]
  N3["29.3 TLP in practice"]
  N4["29.4 Work log"]
  N5["29.5 Handover"]
  N6["29.6 Urgent path"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Weekly rhythm"]
  N2["29.2 Requirements"]
  N3["29.3 TLP in practice"]
  N4["29.4 Work log"]
  N5["29.5 Handover"]
  N6["29.6 Urgent path"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Weekly rhythm]
    |
    v
[29.2 Requirements]
    |
    v
[29.3 TLP in practice]
    |
    v
[29.4 Work log]
    |
    v
[29.5 Handover]
    |
    v
[29.6 Urgent path]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) run a weekly CTI cycle; (2) prioritise with intelligence requirements; (3) apply TLP correctly in daily handling; (4) maintain a work log.

29.1 Weekly rhythm

Monday: review requirements and open items. Daily: triage incoming items, verify urgent ones, push indicators. Thursday: draft the weekly brief. Friday: send feedback to HSSC and close items. A rhythm keeps a small team predictable.

Amara keeps to the rhythm even in quiet weeks, because regular briefs and feedback build trust with readers and HSSC. When an urgent item arrives, the rhythm bends but the log records what was moved, so nothing is quietly dropped. The rhythm is written on the team's board.

29.2 Requirements

HCHT's priority intelligence requirements include: campaigns targeting UK and EU health providers; vulnerabilities in products in the inventory; credential exposure of HCHT accounts; threats to medical devices. Items outside them get a light touch.

Each requirement has a named customer, such as the identity team for credential exposure and clinical engineering for device threats, and is reviewed every six months. Amara checks each item against the list during triage, which makes her decisions quicker and easier to explain. Items outside the requirements are logged briefly in case they become relevant later.

29.3 TLP in practice

TLP:CLEAR may be shared publicly. TLP:GREEN within the community but not publicly. TLP:AMBER within the recipient organisation and its clients on a need-to-know basis; AMBER+STRICT within the organisation only. TLP:RED to named recipients only. When HCHT re-shares, it keeps the original label or stricter.

Amara checks the label before forwarding anything and keeps it on any summary she writes from a labelled report. Amara learned that AMBER allows sharing with HCHT's clients on a need-to-know basis, but AMBER+STRICT does not, which matters when a supplier asks for details. When unsure, she asks the original source before sharing, and records the answer.

29.4 Work log

Record each item: arrival, source, TLP, grade, decision, actions, closure. The log supports handover, audit and failure review.

Amara's log is a table in the team's database with one row per item and a column for each field. Closure records the outcome, such as "blocked", "no action, not applicable" or "shared back to HSSC". The log makes the weekly brief quicker to write, since most of its content comes straight from the week's closed items, and it shows at a glance what is still open.

29.5 Handover

When Amara is away, the log tells her supervisor what is pending.

Each open item shows its next step and deadline, so the supervisor can continue without calling her. Amara adds a short note to items that need context not obvious from the fields, such as a pending answer from a supplier. Before leave, she spends half an hour checking that every open item is current. After returning, she reads what changed before resuming work, which takes minutes rather than an anxious morning of catching up.

29.6 Urgent path

Some items cannot wait for the weekly rhythm: a campaign actively hitting HCHT mailboxes, or a vulnerability under exploitation in an internet-facing product HCHT runs. The urgent path skips the brief: phone the owner, open a priority ticket, record decisions in the log, and summarise in the next weekly brief.

Amara has used it once, for an actively exploited flaw in a remote access product. The owner was phoned within the hour, the service was restricted to known supplier addresses that afternoon and patched the next morning. The log recorded each step, and the weekly brief summarised what happened. A short review afterwards confirmed the urgent path worked.

Worked example

On Wednesday an HSSC TLP:AMBER+STRICT item reports a supplier compromise affecting a pathology system HCHT uses. Amara logs it, informs the pathology system owner directly (inside HCHT), and does not forward it to the supplier, because AMBER+STRICT forbids sharing outside HCHT. The supervisor asks HSSC whether the supplier may be contacted.

Synthetic case. The item and supplier are invented.

Errors and limits

Rhythms break during incidents; the log keeps continuity.

Exercises

Synthesis

Run a steady rhythm, steer by requirements, apply TLP exactly and keep a log.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →