Chapter 9 — Threat intelligence and OSINT: tools and methods
Lesson map
Lesson 09 published. Map, example, EX033.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Platform basics"]
N2["9.2 Triage"]
N3["9.3 Grading"]
N4["9.4 Tagging"]
N5["9.5 OSINT tools"]
N6["9.6 Notes"]
N7["9.8 Practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX033"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Platform basics"]
N2["9.2 Triage"]
N3["9.3 Grading"]
N4["9.4 Tagging"]
N5["9.5 OSINT tools"]
N6["9.6 Notes"]
N7["9.8 Practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX033"]
[Learning outcomes]
|
v
[9.1 Platform basics]
|
v
[9.2 Triage]
|
v
[9.3 Grading]
|
v
[9.4 Tagging]
|
v
[9.5 OSINT tools]
|
v
[9.6 Notes]
|
v
[9.8 Practice]
|
v
[Worked example] --> [Exercise EX033]
Learning outcomes
You will (1) use a CTI platform's basic functions; (2) apply triage and grading methods; (3) tag items with ATT&CK techniques; (4) use OSINT tools ethically.
9.1 Platform basics
The college platform imports STIX bundles, shows objects and relationships, applies TLP markings and exports lists for the DNS filter and email gateway. Tomás uses it for storage and search, his scripts for checks.
Keeping storage in the platform and checks in scripts lets Tomás test his code on synthetic data without touching the stored objects. The platform's TLP markings are what make filtered exports to ESX possible. Exports for the DNS filter and email gateway are validated by his scripts and the allow list before they become configuration requests.
9.2 Triage
Four questions: relevant to Ashgrove? timely? actionable? source known? Items failing the first are logged and closed.
Relevance comes first because an item about software Ashgrove does not run can be closed without further work. Timeliness matters next, since an indicator from last year may have been reassigned. An item that passes all four questions moves on to grading and a note, while failures are logged with a one-line reason. Source known is the last question because an anonymous claim may still be relevant and timely, but it needs more checking before any action. Tomás asks ESX about such items rather than discarding them.
9.3 Grading
The Admiralty scale: source reliability A–F, information credibility 1–6. ESX is usually B; an unverified social-media claim F6.
Reliability grades the source's record over time, while credibility grades this particular claim. Keeping the two apart means a reliable source can still send an item that is only possible, such as B3. Tomás records both letters and the reason in the platform, and the supervisor reviews new or unusual grades during their weekly triage. The worked example's B2 grade shows how the two letters combine: a usually reliable log source and a claim that is probably true. The supervisor checks new F-graded sources, since they are rarely worth action without corroboration.
9.4 Tagging
Tag only what the text supports: "students received fake grade notices with links" supports T1566.
If a report only says that a domain was registered, tagging it T1566 would claim that phishing happened when nobody has seen it. Over-tagging also distorts the weekly counts by technique, which management reads. Tomás quotes the sentence that supports each tag in the platform note, so a reviewer can check the link. Tags are reviewed in the weekly triage, alongside the grades and relevance decisions.
9.5 OSINT tools
Certificate-transparency search for lookalike college domains; approved passive DNS; public vulnerability databases. All used within their terms; nothing that contacts suspicious sites.
Certificate-transparency logs are public records of issued certificates, so searching them never contacts the lookalike site itself. Passive DNS shows past resolutions from data collected by others, again without touching the domain. Tomás records the tool, the query and the date with each finding, as provenance for the note. Approved tools are listed on the safety sheet, so students know which searches are allowed. New tools are added only after the supervisor checks their terms and confirms they stay passive.
9.6 Notes
Three lines: what, why it matters here with confidence, action and owner.
For the lookalike domain, the three lines were: a new lookalike registered yesterday; likely phishing preparation with moderate confidence; email team to block and supervisor to request takedown. Owners can act on a note of that length without reading the source. The full source stays linked in the platform for anyone who needs it. The three-line format is the same in tickets, emails to owners and platform notes, so readers learn where to find the action. Confidence is stated in words such as moderate or high, with the reason after it.
9.7 Tool limits
A platform shows what it was given. If ESX did not share an object, it is absent; absence in the platform is not absence in the world.
Tomás writes the scope of every platform search in his notes, such as 'no object in ESX's shared collection'. That wording keeps readers from treating an empty search as a statement about the world. Where the question matters, he also searches approved public sources or asks ESX directly whether other members have seen the item.
9.8 Practice
Tomás triages twenty items each week with his supervisor and compares decisions to build consistency.
Comparing decisions shows where their judgments differ, such as relevance of advisories about supplier software. Each difference is discussed and the agreed reason is written down, so the next similar item is handled the same way. Over the term, the comparison shows whether Tomás can triage alone on routine items. The twenty items are chosen by the supervisor to include easy, difficult and borderline cases. Disagreements found in the weekly practice are recorded with the agreed outcome, which later helps new students.
Recording methods
Each triage decision and grade is logged with a one-line reason. Reviewing these reasons monthly shows whether Tomás and his supervisor apply the same standards, and new placement students learn from real examples.
Worked example
A certificate-transparency search finds "ashgrove-studentportal.example" issued yesterday. Not a college domain. Tomás grades the finding B2 (reliable log, probable impersonation), tags T1583 (Acquire Infrastructure), and writes: "New lookalike of student portal registered yesterday; likely phishing preparation; moderate confidence. Action: email team to block; supervisor to request takedown."
Synthetic case. The domain is invented.
Errors and limits
Lookalike names can be innocent, such as a student society site; check before takedown.
Exercises
- EX033 — Lookalike tag. Why tag the new lookalike with T1583 rather than T1566? Rubric: 3 = preparation, infrastructure acquired, no emails seen yet; 2 = partial; 1 = no difference; 0 = none.
- EX034 — Grade explanation. Explain the B2 grade for the lookalike finding. Rubric: 3 = B reliable log source; 2 probably true impersonation; 2 = one; 1 = wrong; 0 = none.
- EX035 — Absence caution. Why is absence from the platform not proof of absence? Rubric: 3 = platform only holds what was shared; 2 = partial; 1 = it is proof; 0 = none.
- EX036 — Innocent lookalike. What should be checked before requesting takedown? Rubric: 3 = whether legitimate (e.g. student society); 2 = partial; 1 = vague; 0 = none.
Synthesis
Use the platform for storage and search, triage and grade consistently, tag carefully and keep OSINT passive and lawful.
Continue studying — chapter 09 of 18
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →