◇ OpenCyber Academy
Postgraduate · Chapter 2 · English

Chapter 2 — Threat intelligence and OSINT: current practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Threat intelligence and OSINT: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 What mature teams do"]
  N2["2.2 Sourcing mix"]
  N3["2.3 Automation"]
  N4["2.4 Technique-centred practice"]
  N5["2.5 Starting small"]
  N6["2.6 Common anti-patterns"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 What mature teams do"]
  N2["2.2 Sourcing mix"]
  N3["2.3 Automation"]
  N4["2.4 Technique-centred practice"]
  N5["2.5 Starting small"]
  N6["2.6 Common anti-patterns"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 What mature teams do]
    |
    v
[2.2 Sourcing mix]
    |
    v
[2.3 Automation]
    |
    v
[2.4 Technique-centred practice]
    |
    v
[2.5 Starting small]
    |
    v
[2.6 Common anti-patterns]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) survey how mature CTI teams operate today; (2) compare internal, community and commercial sourcing; (3) assess the role of automation and its limits; (4) position a new function realistically.

2.1 What mature teams do

Mature teams run a requirements process, maintain a threat profile of relevant adversaries and techniques, feed detection engineering, support incident response and brief leadership. NIST SP 800-150 emphasises sharing relationships and clear rules for what can be shared. Many teams use a threat intelligence platform storing STIX 2.1 objects and exchanging them over TAXII 2.1. For a new function like NLG's, this list shows the destination rather than the first year's scope. Rafael uses it to explain to leadership what a mature team does, then picks the parts that match NLG's decisions: requirements, a sector threat profile and support for detection engineering.

2.2 Sourcing mix

Internal telemetry and incidents give the most relevant evidence. Communities like FPSC give sector context and early warning. Commercial providers add breadth and finished reporting. Open sources — advisories, vendor research, certificate logs — fill gaps when collected lawfully and within terms of service. Rafael's benchmarking with peer firms showed that buying broad commercial feeds first often brings low relevance. He starts with internal incident review and FPSC membership, which give the most relevant evidence for NLG, and defers commercial spending until requirements show gaps. The source catalogue records each source, its terms of use and which requirements it serves.

2.3 Automation

Automation ingests, deduplicates, enriches and distributes indicators. It does not judge relevance well, nor write assessments. Teams that automate everything flood defenders with low-value indicators; those that automate nothing drown in copy-paste. At NLG, the platform ingests FPSC indicators and removes duplicates automatically, but deciding whether an advisory matters to the customs platform is an analyst's job. Rafael limits automatic distribution to indicators that pass the triage rule, so the operations centre receives fewer, more relevant items. He reviews the automation each quarter for items that slipped through or were wrongly filtered.

2.4 Technique-centred practice

Following Bianco's Pyramid of Pain, mature teams invest in technique-level intelligence mapped to ATT&CK, because detections built on behaviour last longer than those built on hashes and addresses. For NLG, technique-level intelligence means describing how adversaries use valid accounts or remote services against logistics firms, so detections can look for that behaviour. Hashes and addresses from FPSC still help in incidents, but they change quickly. Rafael's final project builds its backlog from techniques for this reason, and maps each item to ATT&CK so the operations centre can track coverage.

2.5 Starting small

A two-person team should pick a few requirements, one community, internal incident data and a modest platform — and prove value before expanding. Rafael's first year follows this advice: a handful of requirements from the decision interviews, FPSC as the one community, internal incident review, and an open-source platform. Proving value means showing decisions that intelligence informed, such as segmentation funding. Expansion, such as a commercial feed, waits until requirements show a gap that existing sources cannot fill. He agrees this plan with the COO before spending anything.

2.6 Common anti-patterns

Buying several feeds before defining requirements; publishing a daily newsletter nobody reads; measuring success by indicator volume; keeping intelligence inside the CTI team rather than embedding it in detection and response workflows. Peer firms in FPSC described the first anti-pattern directly: they bought large feeds and later cut them for low relevance. Rafael uses the list as a check on his own plan. Instead of a daily newsletter, NLG gets products tied to decisions; instead of counting indicators, he measures consumer actions; and an analyst is embedded in the operations centre two days a week.

Worked example

Rafael benchmarks against three peer firms through FPSC conversations. Two bought large commercial feeds first and later cut them for low relevance. He chooses FPSC membership plus internal incident review for year one, with a small STIX-capable platform, and defers commercial spending until requirements show gaps.

Synthetic case. The peers and choices are invented.

Errors and limits

Peer practice is anecdotal; what works for a large firm may not suit NLG.

Exercises

Synthesis

Mature practice is requirements-led, technique-centred and selectively automated; start small and prove value.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →