Chapter 30 — Threat intelligence and OSINT: Laboratory II | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 The task"]
  N2["30.2 Why by hand"]
  N3["30.3 Patterns"]
  N4["30.4 Peer review"]
  N5["30.5 Memo"]
  N6["30.6 Identifiers and versions"]
  N7["30.7 Assessment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 The task"]
  N2["30.2 Why by hand"]
  N3["30.3 Patterns"]
  N4["30.4 Peer review"]
  N5["30.5 Memo"]
  N6["30.6 Identifiers and versions"]
  N7["30.7 Assessment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 The task]
    |
    v
[30.2 Why by hand]
    |
    v
[30.3 Patterns]
    |
    v
[30.4 Peer review]
    |
    v
[30.5 Memo]
    |
    v
[30.6 Identifiers and versions]
    |
    v
[30.7 Assessment]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) produce a STIX 2.1-style bundle by hand from a synthetic incident; (2) apply TLP marking; (3) peer-review a classmate's bundle; (4) explain choices in a short memo.

30.1 The task

From a synthetic incident description — a phishing email, a credential page, a later suspicious login — students write a JSON bundle containing an indicator, an attack-pattern for T1566, an attack-pattern for T1078, a relationship linking them, and a report object. Each object gets an identifier, created and modified timestamps and a TLP marking reference.

The incident is small on purpose, so students can focus on modelling it correctly rather than on volume. Students are reminded that the bundle will be reviewed by a peer and must be correct enough that another HSSC member could import it without fixing anything by hand.

30.2 Why by hand

Writing objects by hand teaches what each field means before tools hide it. Students use Python's json module only to check that the file parses.

Amara finds that writing the relationship object by hand makes her think about direction: does the indicator indicate the attack pattern, or the other way round? The specification answers it, and she checks it rather than guessing. Tools are allowed later in the course, once students know what a correct object looks like and can spot when a tool produces one that is wrong.

30.3 Patterns

STIX indicators carry a pattern in STIX pattern language, for example matching a domain name value. Students copy the form from the specification rather than inventing syntax, and cite the section.

Amara copies the pattern for a domain name exactly, then checks that the value inside it matches the indicator in the incident description. A typo in a pattern produces a valid file that matches nothing, which would leave HCHT believing it was protected. Peer reviewers are asked to check each pattern against the incident text.

30.4 Peer review

Pairs swap bundles and check: does every relationship point to objects that exist? Are timestamps in UTC? Is the TLP marking present on each object? Is any personal data present?

Reviewers write their findings as comments on the bundle, each naming the object and the problem. Personal data is the easiest mistake to miss, since the synthetic incident includes a staff name that does not belong in a shareable bundle. Authors fix the problems and reply to each comment, which shows how they dealt with it.

30.5 Memo

A half-page memo explains modelling choices: why a relationship type was chosen, what was left out and why.

Amara's memo explains that she left out the victim's identity because it is not needed by other members and would add personal data. She chose the "indicates" relationship between the indicator and the phishing attack pattern, following the specification. A second relationship, linking phishing to the later login, was omitted because the evidence connecting them is only the timing, and she did not want the bundle to state as fact what is an inference.

30.6 Identifiers and versions

STIX identifiers combine the object type and a UUID. When an object changes, its identifier stays the same and the modified timestamp moves forward. Students who create a new identifier for every edit break references from other objects, a mistake peer reviewers learn to spot quickly.

Amara's reviewer found that she had done this once. She had created a new identifier when correcting the indicator's pattern, which left the relationship pointing to the old object. Fixing it meant restoring the original identifier and updating the modified timestamp. The mistake is now on the class checklist for peer review, and Amara checks her own bundles for it before submitting.

30.7 Assessment

Marks reward a valid, minimal bundle with correct references and labels, a thoughtful memo and constructive review comments on a peer's work.

Marks are higher for a bundle that contains only what the incident supports. Extra objects that add guesses or personal data lose marks, because in practice they would mislead or expose others. The memo is judged on whether it explains choices clearly and honestly, including what was left out. Review comments earn credit when they are specific and help the author fix a problem.

Worked example

Amara's reviewer finds her relationship object points to an attack-pattern identifier with a typo, so the link dangles. She fixes it and adds a small script check: every relationship's source and target identifiers must exist in the bundle.

Synthetic case. The incident is invented teaching material.

Errors and limits

Hand-written bundles are for learning; production systems generate and validate them with tools.

Exercises

EX088 — Dangling link. What check catches a relationship pointing to a missing object?
Show marking criteria
Rubric: 3 = verify source_ref/target_ref exist among bundle ids; 2 = partial; 1 = JSON parse; 0 = none.
EX089 — Edit semantics. When editing a STIX object, what stays the same and what changes?
Show marking criteria
Rubric: 3 = id same; modified timestamp updates; 2 = one; 1 = new id; 0 = none.
EX090 — Review list. Give three peer-review checks for a bundle.
Show marking criteria
Rubric: 3 = references exist, UTC timestamps, TLP markings (or no personal data); 2 = two; 1 = one; 0 = none.

Synthesis

Hand-build a small bundle to learn STIX, review rigorously and explain your modelling choices.

Continue studying — chapter 30 of 40

← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →