◇ OpenCyber Academy
Master's · Chapter 2 · English

Chapter 2 — Threat intelligence and OSINT: advanced seminar

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Threat intelligence and OSINT: advanced seminar

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Cycle versus practice"]
  N2["2.2 Three levels"]
  N3["2.3 Models as tools for tasks"]
  N4["2.4 OSINT at seminar depth"]
  N5["2.5 TLP and sharing culture"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Cycle versus practice"]
  N2["2.2 Three levels"]
  N3["2.3 Models as tools for tasks"]
  N4["2.4 OSINT at seminar depth"]
  N5["2.5 TLP and sharing culture"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Cycle versus practice]
    |
    v
[2.2 Three levels]
    |
    v
[2.3 Models as tools for tasks]
    |
    v
[2.4 OSINT at seminar depth]
    |
    v
[2.5 TLP and sharing culture]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) compare the intelligence cycle with CTI practice in a SOC; (2) explain strategic, operational and tactical intelligence; (3) relate the kill chain, Diamond Model and ATT&CK to analyst tasks; (4) discuss OSINT's legal and ethical limits at seminar depth.

2.1 Cycle versus practice

Textbook intelligence moves through direction, collection, processing, analysis, dissemination and feedback. In a port SOC the cycle is compressed and noisy: requirements arrive as incident tickets, collection is a feed subscription, and feedback is rare. Seminar discussion should ask where the cycle breaks — usually at direction and feedback.

Lucía's question tests one point where the cycle breaks. CPSG members receive indicators by TAXII subscription, so collection works; what nobody measured was dissemination into controls, the time from publication to a block rule. Her study adds a feedback loop the group never had.

2.2 Three levels

Strategic intelligence informs boards about adversary intent and trends; operational intelligence describes campaigns and their timing; tactical intelligence supplies indicators and technique detail. Lucía's study sits at the tactical–operational boundary: indicators and how quickly they become controls.

Lucía's seminar bulletin about the phishing wave against port agents shows the boundary in practice: its campaign timing is operational, while its indicators are tactical. Her study measures the tactical part, how fast indicators become block rules, and says nothing about whether board-level strategy changed because of CPSG.

2.3 Models as tools for tasks

Hutchins et al. help decide where to place controls across phases. The Diamond Model helps pivot from one event to related events through shared infrastructure or capability. ATT&CK supplies a common vocabulary — for example T1566 Phishing or T1071 Application Layer Protocol — that lets a sharing group describe behaviour beyond fragile indicators; Bianco's Pyramid of Pain ranks behaviour as more costly for adversaries to change than hashes, IP addresses or domains.

Lucía's seminar mapping of the port-agent phishing wave to T1566 is the example: the bulletin's domains and IP addresses will be stale within days, but the behaviour description remains useful to members who never saw the original indicators.

2.4 OSINT at seminar depth

Open sources include company filings, ship-tracking broadcasts, public code repositories and news. Using them still raises duties: data-protection law where people are identifiable, platform terms, and the risk of tipping off subjects. Seminar exercises use synthetic profiles only.

For a ports group the risk is concrete. Ship-tracking broadcasts and company filings can be combined to show which agent handled which vessel, and identify the staff targeted by the phishing wave. Lucía's study needs none of that: her data are timings from members' controls, so OSINT on people stays outside the design, and seminar exercises use synthetic profiles instead.

2.5 TLP and sharing culture

FIRST TLP 2.0 defines CLEAR, GREEN, AMBER, AMBER+STRICT and RED. Communities like CPSG depend on members honouring labels; one breach can end sharing for years.

CPSG's collection is TLP:AMBER, which is why Lucía needs the governance board's agreement and why her dissertation, written for the university library, must be TLP:CLEAR. A figure caption naming a port's city would have been such a breach, and the leak reviewer caught one before submission. The board's three conditions, groups of at least three, no port names and deletion of raw timings, are how Lucía's study honours AMBER while still producing a public dissertation.

Worked example

In seminar, Lucía presents a CPSG bulletin about a phishing wave against port agents. She classifies it as operational (campaign timing), maps the behaviour to T1566, notes that the indicators are low on the Pyramid of Pain, and argues that the ATT&CK mapping is the more durable contribution.

Synthetic case. The bulletin and phishing wave are invented.

Errors and limits

Treating every feed as "intelligence" confuses data with analysis. OSINT legality varies by jurisdiction; seminar conclusions are not legal advice.

Exercises

Synthesis

Know where the cycle breaks, label the level, prefer durable behaviour descriptions, and practise OSINT within law, terms and TLP.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →