Chapter 4 — Threat intelligence and OSINT: core methods | Professional Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Threat intelligence and OSINT: core methods

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Triage"]
  N2["4.2 Grading"]
  N3["4.3 Tagging"]
  N4["4.4 Calibrated words"]
  N5["4.5 Alternatives"]
  N6["4.6 Notes"]
  N7["4.7 Consistency"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Triage"]
  N2["4.2 Grading"]
  N3["4.3 Tagging"]
  N4["4.4 Calibrated words"]
  N5["4.5 Alternatives"]
  N6["4.6 Notes"]
  N7["4.7 Consistency"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Triage]
    |
    v
[4.2 Grading]
    |
    v
[4.3 Tagging]
    |
    v
[4.4 Calibrated words]
    |
    v
[4.5 Alternatives]
    |
    v
[4.6 Notes]
    |
    v
[4.7 Consistency]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) triage, grade and tag intelligence; (2) write calibrated judgments; (3) consider alternative explanations; (4) produce short, actionable notes.

4.1 Triage

Relevant? Timely? Actionable? Source known? Most items fail relevance and are logged only. Each of the four triage questions removes a different kind of noise from the forty weekly items. An item about a system BIB does not run fails relevance; a forty-day-old address list fails timeliness; an item with nothing to block or change fails actionability. An unknown source does not fail outright but lowers the grade. Items that fail are logged with their reason, so a later review can check the decision.

4.2 Grading

Admiralty scale: source A–F, information 1–6. FSSG with a good record: B. A vendor blog: C until its record is known. Anonymous posts: F. Source and information are graded separately, because a reliable source can pass on doubtful information and an unknown source can be right. FSSG earns B through a record of accurate items, and a new vendor blog starts at C until its claims can be checked. In the scoring lab, the A source behind Q3 adds three points, while the F forum adds none.

4.3 Tagging

Tag ATT&CK techniques supported by the text: invoice fraud by email (T1566 if links or attachments are used; otherwise a social-engineering pretext), credential use (T1078), encryption for impact (T1486). The rule is to tag only what the text supports. A bank-detail email without a link or attachment is a pretext, so it should not be tagged T1566 by habit. Accurate tags let Priya later count which techniques FSSG reports most often against brokers, and they point her to the ATT&CK mitigation pages when she drafts control requests.

4.4 Calibrated words

Use a fixed scale: unlikely (20–45%), roughly even (45–55%), likely (55–80%), very likely (80–95%). ICD 203 asks analysts to express uncertainty clearly and explain confidence. A fixed scale stops two readers from hearing the same word differently. When Priya writes 'likely' in the failed-login note, the operations manager knows she means roughly 55 to 80 per cent, not certainty. The scale also feeds her accuracy tracking in Chapter 10, where she later checks whether her 'likely' judgments happened more often than her 'unlikely' ones. Words outside the scale, such as 'probable', are later caught by the brief check Priya extends in Chapter 11.

4.5 Alternatives

Before concluding, ask: what else could explain this? A spike in failed logins may be an attack — or a password-policy change forcing resets. Asking the question early, before writing anything, prevents a confident report that later proves wrong. In the worked example, the portal update and the rise in support calls fit a lockout explanation better than an attack. Yet a small share of attempts from addresses FSSG flagged keeps credential stuffing open. Writing both into the note lets IT and support act on each, instead of betting on one.

4.6 Notes

Three lines: what happened; what it means for BIB with likelihood and confidence; what to do and who does it. The failed-login note from the worked example shows the three-line format in practice. Line one states that failed logins tripled overnight; line two gives the likely cause, the portal update, with moderate confidence and the minority stuffing signal. Line three names the actions: IT reviews the flagged addresses and support sends clients reset guidance. A reader who stops after line one still knows something happened.

4.7 Consistency

Priya and the IT manager grade the same five items monthly and compare. Comparing grades shows where the scale is being read differently. If Priya grades an item B and the IT manager grades it D, they discuss the evidence and agree a rule for similar items. The exercise also prepares him to cover her routine, because he will be grading items when she is away and needs to apply the same standard. Disagreements and the rules agreed to settle them go into a short note kept with the scoring records.

4.8 Time

Triage in minutes; analysis only for items that pass. With about forty items a week and one working day, Priya cannot analyse everything. Triage takes a few minutes per item and filters out most of them. Only items that pass relevance and timeliness get analysis time, which is why scoring in Chapter 5 matters. Logged-only items are still read in summary each week, so nothing unusual is missed entirely. Priya times her Monday triage for a few weeks to confirm that forty items really fit inside the morning.

Business email compromise signs

Requests to change bank details, urgency, a slightly altered sender domain and replies directed elsewhere are common signs. Intelligence about current pretexts — fake insurer mergers, new payment portals — helps staff recognise them quickly, and gives the operations manager concrete examples for training sessions.

Worked example

Failed logins on the client portal triple overnight. Alternative explanations: credential stuffing, or clients locked out after a portal update. Priya checks: the update changed the login page and support calls rose. She writes: "Spike likely caused by the update (moderate confidence); a small share of attempts came from addresses FSSG flagged, so stuffing may also be occurring. Action: IT to review those addresses; support to send clients reset guidance."

Synthetic case. The spike is invented.

Errors and limits

Scales reduce ambiguity, not error; track outcomes.

Exercises

EX016 — Grade a blog. What grade would a new vendor blog's source receive and why? Rubric: 3 = C (or similar) until record known; 2 = grade; 1 = A; 0 = none.
EX017 — Alternative. Give an alternative explanation for a failed-login spike. Rubric: 3 = policy change/update lockouts; 2 = vague; 1 = minimal attempt; 0 = none.
EX018 — Likely band. What range does "likely" cover on the scale? Rubric: 3 = 55–80%; 2 = close; 1 = wrong; 0 = none.
EX019 — Two causes. Why did Priya's note mention both causes? Rubric: 3 = evidence for both; avoid ignoring minority attack; 2 = partial; 1 = indecision; 0 = none.
EX020 — Note lines. What are the three lines of a note? Rubric: 3 = what, meaning with likelihood/confidence, action/owner; 2 = two; 1 = one; 0 = none.

Synthesis

Triage fast, grade and tag with reasons, write calibrated judgments, consider alternatives and keep notes actionable.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →