Chapter 20 — Threat intelligence and OSINT: engineering context
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 Data, information, intelligence"]
N2["20.2 Consumers and decisions"]
N3["20.3 The service view"]
N4["20.4 Mission statement"]
N5["20.5 Frameworks as context"]
N6["Practice note — Feedback from consumers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 Data, information, intelligence"]
N2["20.2 Consumers and decisions"]
N3["20.3 The service view"]
N4["20.4 Mission statement"]
N5["20.5 Frameworks as context"]
N6["Practice note — Feedback from consumers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 Data, information, intelligence]
|
v
[20.2 Consumers and decisions]
|
v
[20.3 The service view]
|
v
[20.4 Mission statement]
|
v
[20.5 Frameworks as context]
|
v
[Practice note — Feedback from consumers]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) describe the CTI life cycle as an engineered service; (2) distinguish data, information and intelligence; (3) identify consumers and their decisions; (4) frame Lantern's mission in one sentence.
20.1 Data, information, intelligence
Data are raw observations: a domain in a feed. Information is organised data: the domain was seen in phishing against utilities. Intelligence is analysed information relevant to a decision: BEN should block the domain at DNS and hunt for past contacts because the campaign targets distribution operators.
The difference lies in the analysis and the decision. A feed full of domains is data however large it is. Kofi asks of every Lantern product which decision it supports; if none, it is not yet intelligence.
20.2 Consumers and decisions
Consumers include SOC analysts (block, hunt, escalate), OT engineers (approve changes), risk managers (prioritise investment), executives (accept risk) and partners (their own decisions). Each needs different formats and timeliness.
Kofi lists each consumer with the decision they make, how quickly they need input and in what form. The SOC wants machine-readable indicators within minutes; executives want a quarterly page in plain language. A single product cannot serve both well. The list also shows consumers nobody was serving, such as procurement, which needed warnings about suppliers.
20.3 The service view
Lantern is a service with inputs (feeds, OSINT, internal telemetry), processing (validation, enrichment, analysis) and outputs (blocks, reports, shared objects). Service levels apply: for example, high-confidence indicators reach IT enforcement within 30 minutes.
Thinking of Lantern as a service gives it measurable promises. A promise such as the thirty-minute target can be checked from logs each week, and a missed target becomes a problem to investigate. Kofi reports performance against each service level monthly, which shows consumers what they can rely on and shows engineers where to work.
20.4 Mission statement
"Lantern turns shared and open-source threat information into timely, trustworthy, legally collected intelligence that helps BEN prevent and detect attacks on its IT and OT environments." Every later requirement should trace to it.
Kofi tests each proposed feature against the statement. A proposal to collect personal social profiles of suspected actors fails on legally collected. A feature that adds data analysts never use fails on helping BEN prevent or detect. The statement is short enough to remember, which is why it works in design meetings.
20.5 Frameworks as context
The Diamond Model, the kill chain, ATT&CK, STIX/TAXII and TLP give a common language with partners. Engineering adopts them where they help interoperability and analysis, not as decoration.
Kofi adopted the frameworks in stages. STIX and TAXII came first because partners already used them. ATT&CK tags were added once analysts were trained to assign them consistently; before that, tags were applied unevenly and comparisons across reports misled. Each framework is listed with the problem it solves for BEN, so its use can be reviewed.
Practice note — Feedback from consumers
Kofi adds a one-click 'useful / not useful' control to every Lantern report. The counts are crude, but they close a loop the intelligence cycle usually leaves open, and they reveal which products deserve investment.
Worked example
Kofi interviews five consumers. The OT engineer says: "I don't want indicators; I want to know if a campaign targets our relay vendor." That is a strategic-operational need, so Lantern adds a vendor-watch report instead of more feeds.
Synthetic case. Interviews are invented.
Errors and limits
More feeds do not equal more intelligence. Missions that promise "complete visibility" are unverifiable.
Exercises
- EX058 — DII ladder. Classify "domain seen in phishing against utilities". Rubric: 3 = information (organised context, not yet decision-specific); 2 = right with weak reason; 1 = intelligence; 0 = none.
- EX059 — Consumer need. What output best serves the OT engineer's stated need? Rubric: 3 = vendor-focused campaign report/watch; 2 = vague report; 1 = more indicators; 0 = none.
- EX060 — Mission test. Which word in Lantern's mission statement commits to lawful OSINT? Rubric: 3 = "legally collected" identified; 2 = points to collection; 1 = wrong; 0 = none.
Synthesis
Climb from data to intelligence, serve named decisions, and anchor everything in a testable mission.
Continue studying — chapter 20 of 50
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →