Chapter 7 — Threat intelligence and OSINT: organizational integration
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Integration points"]
N2["Lab — dissemination gate"]
N3["7.2 Reading the result"]
N4["7.3 Fail closed"]
N5["7.4 Service agreements"]
N6["7.5 Measuring integration"]
N7["7.6 Clients and partners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Integration points"]
N2["Lab — dissemination gate"]
N3["7.2 Reading the result"]
N4["7.3 Fail closed"]
N5["7.4 Service agreements"]
N6["7.5 Measuring integration"]
N7["7.6 Clients and partners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Integration points]
|
v
[Lab — dissemination gate]
|
v
[7.2 Reading the result]
|
v
[7.3 Fail closed]
|
v
[7.4 Service agreements]
|
v
[7.5 Measuring integration]
|
v
[7.6 Clients and partners]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) embed CTI into security operations, incident response and risk; (2) enforce TLP in dissemination workflows; (3) design service agreements with consumers; (4) measure integration.
7.1 Integration points
CTI feeds detection engineering (technique priorities), the security operations centre (indicators and context), incident response (adversary profiles during incidents, aligned with NIST SP 800-61r3), vulnerability management (exploitation intelligence) and risk (likelihood). Each needs a defined input format and owner. At NLG, each integration point has an owner and a format: the detection team receives technique priorities as backlog items, the operations centre receives indicators through the platform, incident response receives adversary profiles on request, and the risk team receives likelihood updates. Rafael agrees each with its consumer and records it in a service agreement.
Lab — dissemination gate
"""Lab (ch 07): TLP 2.0 dissemination gate - fail closed on unknown labels (synthetic)."""
RANK = {"TLP:CLEAR": 0, "TLP:GREEN": 1, "TLP:AMBER": 2, "TLP:AMBER+STRICT": 3, "TLP:RED": 4}
AUD = {"public": 0, "community": 1, "client": 2, "internal": 3, "named": 4}
items = [("R1", "TLP:GREEN", "community"), ("R2", "TLP:AMBER", "public"),
("R3", "TLP:AMBER+STRICT", "client"), ("R4", "TLP:CLEAR", "public"), ("R5", "AMBER", "internal")]
for rid, lab, aud in items:
if lab not in RANK:
print(rid, lab, aud, "BLOCK unknown label"); continue
print(rid, lab, aud, "ALLOW" if AUD[aud] >= RANK[lab] else "BLOCK")
Run with python3 lab_gate.py. Verified output:
R1 TLP:GREEN community ALLOW
R2 TLP:AMBER public BLOCK
R3 TLP:AMBER+STRICT client BLOCK
R4 TLP:CLEAR public ALLOW
R5 AMBER internal BLOCK unknown label
7.2 Reading the result
A GREEN report to the community is allowed; AMBER to the public is blocked; AMBER+STRICT to a client is blocked, because it is limited to the recipient organisation; CLEAR to the public is allowed. A label written "AMBER" without the TLP prefix is unrecognised, so the gate fails closed and blocks it. Failing closed on an unrecognised label protects FPSC material even when someone makes a simple formatting mistake. Rafael uses these results to explain the gate to the customer-facing teams who most often ask to share intelligence.
7.3 Fail closed
When a label is missing or unknown, block and ask. A gate that guesses will sooner or later leak restricted partner material and damage trust in the community. When the sales manager tried to forward an AMBER+STRICT advisory to a customer, the gate blocked it, and Rafael asked FPSC for a version that could be shared. FPSC agreed to a sanitised GREEN summary, which went to the customer instead. Blocking first and asking afterwards kept NLG's standing in the community and still gave the customer something useful.
7.4 Service agreements
Agree with each consumer what they receive, in what format, how fast and how they give feedback. For example, the operations centre gets validated indicators within four hours of FPSC receipt; leadership gets a monthly two-page brief. Written agreements make expectations clear on both sides, so missed deliveries can be discussed against something concrete. The operations centre knows when to expect validated indicators and how to report false positives; leadership knows the brief will arrive monthly and what it covers. Rafael reviews each agreement every six months, using feedback to adjust timing or format, and records changes.
7.5 Measuring integration
Measure consumer actions: detections created from intelligence, vulnerabilities reprioritised, risk entries updated. Survey consumers twice a year. Counting actions shows whether intelligence changed what consumers do, which is the purpose of the function. Rafael's report lists, for each quarter, detections created, vulnerabilities reprioritised and risk entries updated, with examples. The survey asks consumers what was useful and what they ignored, and the answers shape the next quarter's priorities and products.
The first survey showed that the operations centre valued indicator context more than the indicators themselves, and Rafael changed the format accordingly.
7.6 Clients and partners
NLG serves customers who sometimes ask for threat information. TLP:AMBER allows sharing with clients on a need-to-know basis; AMBER+STRICT does not. Customer-facing teams must know the difference before passing anything on. At NLG, customer-facing staff are trained to check the label before passing anything on and to ask the CTI team when unsure. The sales manager's attempt to forward an AMBER+STRICT advisory showed why. A short guide explains what each label permits, with NLG examples.
The guide is part of induction for new customer-facing staff.
Worked example
A sales manager wants to forward an FPSC AMBER+STRICT advisory to a major customer. The gate blocks it. Rafael asks FPSC whether a version can be released at TLP:AMBER or GREEN; FPSC agrees to a sanitised GREEN summary, which goes to the customer.
Synthetic case. The advisory and customer are invented.
Errors and limits
Automated gates only see labels; mislabelled content still leaks. Train senders.
Exercises
- EX031 — Gate outcomes. Which lab items were blocked, and why? Rubric: 3 = R2 AMBER→public, R3 STRICT→client, R5 unknown label; reasons; 2 = items only; 1 = one; 0 = none.
- EX032 — Fail closed. Defend failing closed on unknown labels. Rubric: 3 = guessing risks leaks/trust; ask originator; 2 = partial; 1 = fail open; 0 = none.
- EX033 — Customer request. How was the sales manager's request resolved lawfully? Rubric: 3 = asked FPSC for sanitised lower-TLP version; 2 = partial; 1 = forwarded; 0 = none.
- EX034 — Service agreement. Draft one consumer service agreement line. Rubric: 3 = consumer, content, format, speed, feedback; 2 = three; 1 = vague; 0 = none.
- EX035 — Integration measure. Name two consumer-side measures of integration. Rubric: 3 = detections created, vulns reprioritised, risk updated, surveys; 2 = one; 1 = indicators ingested; 0 = none.
Synthesis
Integrate CTI at defined points, enforce TLP with a fail-closed gate, agree service levels and measure consumer action.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →