◇ OpenCyber Academy
Professional · Chapter 5 · English

Chapter 5 — Threat intelligence and OSINT: tools and interpretation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Threat intelligence and OSINT: tools and interpretation

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Why score"]
  N2["Lab — triage scoring"]
  N3["5.2 Reading the result"]
  N4["5.3 Interpreting"]
  N5["5.4 OSINT tools"]
  N6["5.6 Adjusting weights"]
  N7["5.7 Spreadsheet versions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Why score"]
  N2["Lab — triage scoring"]
  N3["5.2 Reading the result"]
  N4["5.3 Interpreting"]
  N5["5.4 OSINT tools"]
  N6["5.6 Adjusting weights"]
  N7["5.7 Spreadsheet versions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Why score]
    |
    v
[Lab — triage scoring]
    |
    v
[5.2 Reading the result]
    |
    v
[5.3 Interpreting]
    |
    v
[5.4 OSINT tools]
    |
    v
[5.6 Adjusting weights]
    |
    v
[5.7 Spreadsheet versions]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) use a simple scoring tool for triage; (2) interpret its output critically; (3) use passive OSINT tools within their terms; (4) know when tool output needs human judgment.

5.1 Why score

Priya receives about forty items a week. A transparent score — relevance, freshness, source grade — puts the most useful first. Ordering by hand worked when items were few, but forty a week makes inconsistency likely. A score written as a simple rule can be checked by anyone: three points for relevance, two for freshness within seven days, and up to three for source grade. The lab that follows applies that rule to five synthetic items and prints a decision for each.

Lab — triage scoring

"""Lab (ch 05): score incoming items on relevance, timeliness and source grade, then sort (synthetic)."""
GRADE = {"A": 3, "B": 2, "C": 1, "D": 0, "E": 0, "F": 0}
items = [("Q1", "broker portal phishing wave", True, 2, "B"),
         ("Q2", "ransomware in manufacturing", False, 1, "B"),
         ("Q3", "flaw in our CRM version", True, 5, "A"),
         ("Q4", "forum claim of broker data sale", True, 1, "F"),
         ("Q5", "old address list", True, 40, "C")]
for qid, title, relevant, age_days, grade in items:
    score = (3 if relevant else 0) + (2 if age_days <= 7 else 0) + GRADE[grade]
    items[items.index((qid, title, relevant, age_days, grade))] = (score, qid, title)
for score, qid, title in sorted(items, reverse=True):
    print(qid, score, title, "-> analyse" if score >= 6 else "-> log only" if score < 5 else "-> check")

Run with python3 lab_triage.py. Verified output:

Q3 8 flaw in our CRM version -> analyse
Q1 7 broker portal phishing wave -> analyse
Q4 5 forum claim of broker data sale -> check
Q5 4 old address list -> log only
Q2 4 ransomware in manufacturing -> log only

5.2 Reading the result

Q3, a flaw in BIB's CRM version from an A-grade source within five days, scores 8 and goes to analysis. Q1, the broker-portal phishing wave from FSSG, scores 7 — analysis. Q4, a forum claim that broker data is for sale, scores 5 — check, because it is relevant and fresh but from an F source. Q5 (relevant but 40 days old) and Q2 (fresh but about manufacturing) score 4 and are logged only. The two items tied at 4 are a reminder that one rule can fail different items for different reasons. Q5 fails freshness, while Q2 fails relevance, and the sorted output alone does not show which was which.

5.3 Interpreting

Scores order work; they do not decide. Q4 is low-grade but could matter if true; Priya checks whether BIB data appears in the claim's sample through FSSG rather than visiting the forum. The lab's thresholds of 6 and 5 are a starting point for Priya's attention, not a verdict. A score of 5 sends Q4 to 'check', which means a cheap verification step rather than full analysis. If FSSG confirms that a sample contains BIB data, the item moves straight onto the urgent path. If FSSG finds nothing, Priya records that answer and closes the ticket with the reason.

5.4 OSINT tools

Certificate-transparency search for lookalikes of bramwell.example; national advisories; vendor vulnerability pages. Used within terms. Each of these passive tools answers one of the requirements written with BIB's consumers. Certificate-transparency logs answer the compliance question about exposure by showing new certificates for names like bramwell-claims.example. National advisories and vendor vulnerability pages answer IT's question about exploited flaws in the CRM and portal. All three are public, used passively and within their terms, so none needs special approval under BIB's policy.

5.5 Tool limits

A score ignores context the tool does not know — such as a planned CRM upgrade making Q3 moot next week. The scoring script sees relevance, age and source grade, and nothing else at all. It does not know that IT plans a CRM upgrade, that marketing launched a new site, or that a partner insurer uses a similar domain. Priya adds that missing context by hand, from colleagues and plans, before acting on a score. For Q3, a planned upgrade next week might change the action from urgent patching to confirming the upgrade date.

5.6 Adjusting weights

If too many irrelevant items reach analysis, adjust weights and document the change. A change might be lowering the relevance weight or raising the threshold for analysis from 6 to 7. Each change is written down with the date, the reason and the items that prompted it. After a month, Priya checks whether the change reduced wasted analysis without dropping items that later proved useful. Undocumented changes would make the monthly review meaningless, because scores from different weeks could no longer be compared.

5.7 Spreadsheet versions

The same scoring works in a spreadsheet; the script is easier to audit. A spreadsheet suits the IT manager when he covers for Priya, because he can see each column. The script is easier to audit, because the rule sits in one line rather than spread across cells that someone might overwrite. Either way, both must produce the same five scores on the lab items before anyone relies on them. Priya keeps the script as the reference version and checks the spreadsheet against it whenever either one changes.

5.8 Review

Monthly, compare scores with what actually proved useful. The review compares each week's scored list with what actually happened to the items. If an item logged only at 4 later turned out to matter, the rule missed something and the weights may need adjusting. If analysed items rarely led to any action, the threshold may be too low. The saved weekly lists, dated and kept with the tickets, make this comparison possible months later. The findings feed weight changes, which are then documented with their date and reason as described earlier in this chapter.

Recording tool runs

Save each week's scored list with the date. Later comparison of scores against what proved useful needs those records.

Worked example

A certificate-transparency search shows "bramwell-claims.example" registered yesterday. Not a BIB domain. Priya scores it high (relevant, fresh, reliable log), checks with marketing that it is not a new campaign site, and asks IT to block it and management to approve a takedown request.

Synthetic case. The domain is invented.

Errors and limits

Scores encode assumptions; review them.

Exercises

Synthesis

Use transparent scoring to order work, interpret it with context, keep OSINT passive and review the tool against outcomes.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →