AMBER can hit and still stay inside | Rapid course Threat intelligence and OSINT

Lesson map

Lesson 12. Map, example, EX058.

flowchart TD
  A["elmfield-giftaid.example"] --> V["Inside valid"]
  V --> H["Inside hits"]
  V --> P{"Label in CLEAR or GREEN?"}
  P -->|No| S["Absent from the community list"]

A match is an internal fact. The label still governs the outbound list.

Logical drawing

in valid
  yes
in hits
  office row
in shareable with community
  no
label
  TLP:AMBER

Learning outcomes

After this chapter, you should be able to:

Place the AMBER domain in valid and in hits.
Keep it out of the community list.
Refuse a feedback line that names it.

12.1 The hit test ignores the label. The share test uses only the label.

hits asks whether the mail value occurs among the valid values. It never reads lab. elmfield-giftaid.example is a valid value, and the office row carries that value, so the tuple is kept. public asks a different question: is lab one of TLP:CLEAR or TLP:GREEN? TLP:AMBER is neither, so the domain is dropped from shareable with community. One value, two tests, two different answers.

The office match is still an EFBN action. The chair hears it the same day, and the domain can be blocked in the email provider's settings. Those actions stay inside the organisation. They are not a reason to put the name on the CCC list. TLP:AMBER, in this case, does not travel with the community feedback. Describing the name there would reveal the item the label withheld.

valid: 3 counted this domain. That count remains compatible with a community list of two. Three kept values, one of them withheld, is two shareable values. The script prints both facts. A note that "corrects" the community list up to three has erased the label.

Lesson table; scroll horizontally to read all columns →

Question	Answer for the AMBER domain
Kept as valid?	Yes
Matched in mail?	Yes, the office row
Shareable with CCC?	No
Blocked inside EFBN?	Yes, in provider settings

12.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered action	Label consequence	Decision
"Block it inside EFBN and tell the chair."	Stays inside	Keep
"Leave it off the community list."	The filter	Keep
"CCC should receive it because the office was hit."	The hit test is not the share test	Refuse
"Drop it from valid so the length becomes 2."	It was valid	Refuse

Synthetic case. The AMBER label is on a classroom indicator.

Errors and limits

Do not treat a mailbox hit as a licence to widen the label.

Apply

EX058 — Two answers. Is elmfield-giftaid.example a hit, and is it shareable with the community?
Show marking criteria
Rubric: 3 = it is a hit on the office row and it is inside valid; it is not shareable because the label is TLP:AMBER; blocking it stays inside EFBN;; 2 = hit yes, community list no;; 1 = one list;; 0 = none.