Four shared values become three valid | Rapid course Threat intelligence and OSINT

Lesson map

Lesson 09. Map, example, EX055.

flowchart TD
  F["Four shared tuples"] --> R["One rejected"]
  R --> V["valid length 3"]
  V --> Q{"Does 3 mean three shareable values?"}
  Q -->|No| K["AMBER is still inside valid"]

The count is the length of valid. Sharing is a later filter.

Logical drawing

shared, in written order
  donate-elmfield.example
  198.51.100.400
  elmfield-giftaid.example
  203.0.113.9
rejected
  198.51.100.400
remaining in valid
  the other three, including AMBER

Learning outcomes

After this chapter, you should be able to:

Count the shared tuples and the rejected one.
Read valid: 3 as a length.
Refuse the claim that all three are community material.

9.1 The length includes the AMBER domain. It excludes only the rejected address.

shared has four pairs. The loop appends a pair to valid when the value is kept, and it continues past 198.51.100.400 after printing invalid:. Three pairs remain, so print("valid:", len(valid)) writes valid: 3. That integer is a length. It is not a list of names, and it is not a count of community items.

The three kept pairs are donate-elmfield.example with TLP:GREEN, elmfield-giftaid.example with TLP:AMBER, and 203.0.113.9 with TLP:CLEAR. The AMBER pair is inside valid. A sentence that reads valid: 3 as "three things EFBN may send to CCC" has skipped the label. The community filter runs later and drops AMBER. The length line has already been printed by then, and it does not change.

The rejected address is absent from the length. It cannot be one of the three. Quoting valid: 3 beside the invalid line is consistent: four minus one.

Lesson table; scroll horizontally to read all columns →

Figure	Meaning
4 shared pairs	The input list
`invalid:` one value	Removed before the length
`valid: 3`	Length of what remained
Community permission	Not this integer

9.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered sentence	Arithmetic	Decision
"Four pairs in, one rejected, length 3."	The loop	Keep
"The AMBER domain is one of the three."	It was appended	Keep
"valid: 3 means three shareable indicators."	The filter has not run	Refuse
"The invalid address is included in the 3."	`continue` skipped it	Refuse

Synthetic case. The length line is one integer.

Errors and limits

Do not spend the integer as if it were a permission.

Apply

EX055 — The integer. What does valid: 3 count, and is the AMBER domain inside that count?
Show marking criteria
Rubric: 3 = three kept pairs; the invalid address is excluded; the AMBER domain is included; the integer is not the community list;; 2 = length 3 includes AMBER and excludes the invalid address;; 1 = the digit only;; 0 = none.