Chapter 6 — Threat intelligence and OSINT: operational workflow | Professional Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Threat intelligence and OSINT: operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 The week"]
  N2["6.2 Tracking"]
  N3["6.3 Coordination"]
  N4["6.4 Urgent path"]
  N5["6.5 Closure"]
  N6["6.6 Cover"]
  N7["6.7 Metrics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 The week"]
  N2["6.2 Tracking"]
  N3["6.3 Coordination"]
  N4["6.4 Urgent path"]
  N5["6.5 Closure"]
  N6["6.6 Cover"]
  N7["6.7 Metrics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 The week]
    |
    v
[6.2 Tracking]
    |
    v
[6.3 Coordination]
    |
    v
[6.4 Urgent path]
    |
    v
[6.5 Closure]
    |
    v
[6.6 Cover]
    |
    v
[6.7 Metrics]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) run a repeatable weekly CTI workflow; (2) track items from arrival to closure; (3) coordinate with IT and the help desk; (4) handle urgent items outside the routine.

6.1 The week

Monday: FSSG items scored and triaged. Tuesday: indicator matching in email and DNS logs; requests drafted. Wednesday: help-desk scam update. Thursday: follow-ups. Last Friday: monthly summary. The fixed days make Priya's part-time work predictable for the colleagues who depend on it. IT knows requests arrive on Tuesday, the help desk knows when its update comes, and her manager knows when the summary lands. Thursday is kept for follow-ups because requests sent on Tuesday need chasing. The urgent path sits outside this week and can interrupt any day when its triggers are met.

6.2 Tracking

Each item gets a ticket: arrival, source, label, grade, score, decision, actions, closure date. Open tickets show what is pending. The ticket turns each item into something with a visible state. When the IT manager covers her routine, he opens the list of open tickets instead of reading her notes. The fields also feed the monthly metrics: arrival and closure dates give the time to action, and the decision field shows how many items were logged only. A ticket left open past its deadline shows up in Thursday's follow-ups, so stalled requests are chased rather than forgotten.

6.3 Coordination

IT applies blocks and patches; the help desk briefs staff; operations changes processes. Priya's requests name the owner and deadline. Naming one owner per request avoids the common failure where everyone assumes someone else will act. For the CRM exploitation report, the owner was the IT manager and the deadline was that evening. Priya's job is to make the request clear and follow it up, not to apply the change herself, since her role description does not cover system changes.

6.4 Urgent path

Active exploitation of BIB's CRM or portal, or a fraud method naming BIB, skips the routine: phone the owner, open a priority ticket, inform the manager. The CRM case in the worked example used exactly this path. The FSSG report arrived on Wednesday, outside Monday's triage, and named the CRM version BIB runs. A phone call reached the IT manager within the hour, rather than an email that might wait. The priority ticket recorded the decision and later held the evidence of the version check.

6.5 Closure

Items close when action is done and verified, or when a decision not to act is recorded with reason. Verification is a required part of closing a ticket, not an optional extra after it. For the CRM patch, Priya checked the version the next morning before closing the ticket. For an item where the decision is not to act, such as Q2 about manufacturing ransomware, the reason is recorded instead. A ticket closed without either cannot be defended at the monthly review.

6.6 Cover

When Priya is away, the IT manager follows the same checklist, using her handover note. The handover note makes cover possible without anyone phoning Priya while she is on leave. It lists open tickets with next steps, scheduled reports and anything urgent in progress. The IT manager already grades five items a month with Priya, so he applies the same scale. Training him as a trained backup becomes part of her plan for the next six months. After each period of cover, Priya reads what he did and updates the note where it was unclear to him.

6.7 Metrics

Items received, analysed, actioned; time from arrival to action; blocks that stopped connections. These counts are cheap to collect from the tickets and show whether the routine produces action. If forty items arrive and only one leads to action, Priya questions her sources or her scoring. The time from arrival to action shows whether urgent items really moved faster. Blocked connections give IT and the managing director a concrete sign of value. Priya reports these numbers in the monthly summary for her manager, with the source of each figure stated beside it.

6.8 Workload

If the week overflows, Priya drops lowest-scored items first and tells her manager. Dropping items by score keeps the decision consistent from week to week and defensible at review. Items at 4 go first, then items in the 'check' band; analysis items stay. Telling her manager matters because a full week every week is a staffing problem, not a personal one. The record of dropped items also helps the monthly review spot something important that was skipped. Over a quarter, the pattern of overflows shows whether the single weekly day is still enough for BIB's needs.

6.9 FSSG feedback

Every month she tells FSSG which items helped BIB; communities improve when members respond. The feedback is specific: which FSSG items led to a block, a process change or a help-desk update, and which were noise for a broker. FSSG can then adjust what it sends to its members. The feedback is shared at GREEN or lower and contains no client details, following the same sanitising rules as any other item. FSSG's sharing agreement covers this feedback, so Priya does not need separate approval each month to send it.

Handover note

A short handover note lists open tickets with next steps, scheduled reports and any urgent items in progress. The IT manager can continue the routine from it without calling Priya on leave.

Worked example

On Wednesday FSSG reports active exploitation of the CRM version BIB runs. Priya uses the urgent path: she phones the IT manager, opens a priority ticket and informs her manager. The vendor fix is applied that evening; she verifies the version the next morning and closes the ticket with evidence.

Synthetic case. The exploitation report is invented.

Errors and limits

Routines can make people miss unusual items; read summaries of logged-only items weekly.

Exercises

EX026 — Ticket fields. List six ticket fields Priya uses. Rubric: 3 = six of arrival, source, label, grade, score, decision, actions, closure; 2 = four; 1 = two; 0 = none.
EX027 — Urgent triggers. What triggers the urgent path? Rubric: 3 = active exploitation of BIB system; fraud naming BIB; 2 = one; 1 = any item; 0 = none.
EX028 — Closure rule. When may an item be closed? Rubric: 3 = action verified, or decision not to act recorded; 2 = one; 1 = anytime; 0 = none.
EX029 — Overflow. What should Priya do when the week overflows? Rubric: 3 = drop lowest-scored first; tell manager; 2 = one; 1 = work weekends silently; 0 = none.
EX030 — CRM case. Describe the steps taken for the CRM exploitation report. Rubric: 3 = phone, priority ticket, manager, patch, verify, close; 2 = most; 1 = some; 0 = none.

Synthesis

Run a weekly routine, track every item, coordinate owners, keep an urgent path and close with evidence.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →