OpenCyber Academy
Technologist · Chapter 14 · English
Course code: OCA-087Chapter 14: OCA-087-C014

Chapter 14 — Threat intelligence and OSINT: methods I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Triage questions"]
  N2["14.2 Grading"]
  N3["14.3 Tagging"]
  N4["14.4 The three-line note"]
  N5["14.5 Consistency"]
  N6["14.6 Time budget"]
  N7["14.7 Logging"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Triage questions"]
  N2["14.2 Grading"]
  N3["14.3 Tagging"]
  N4["14.4 The three-line note"]
  N5["14.5 Consistency"]
  N6["14.6 Time budget"]
  N7["14.7 Logging"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Triage questions]
    |
    v
[14.2 Grading]
    |
    v
[14.3 Tagging]
    |
    v
[14.4 The three-line note]
    |
    v
[14.5 Consistency]
    |
    v
[14.6 Time budget]
    |
    v
[14.7 Logging]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) triage incoming items consistently; (2) grade sources and information; (3) tag items with ATT&CK techniques; (4) write a three-line intelligence note.

14.1 Triage questions

Is it relevant to CMS assets? Is it timely? Is it actionable? Is the source known? Items failing relevance are logged and closed.

Lena asks the questions in that order because each one is cheaper to answer than the next. Relevance needs only the asset list; timeliness needs the date; actionability needs a look at what CMS could change; source needs the record of past items. An MCX item about software CMS does not run stops at the first question, logged and closed in under a minute.

14.2 Grading

The Admiralty scale grades source reliability A–F and information credibility 1–6. MCX, with a long accurate record, is usually B; an anonymous forum post is F. Information confirmed by CMS's own logs is 1.

The two grades are kept separate because a reliable source can pass on doubtful information and an unknown source can be right. B2 for the invoice-phishing item in the worked example means MCX is usually reliable and the report is probably true. If CMS's own gateway logs later show the same sender domains, the credibility part can move to 1.

14.3 Tagging

Lena tags each relevant item with ATT&CK identifiers supported by the text. "Attackers sent invoice emails with links" supports T1566; it does not support T1059 unless the text mentions scripts.

Tagging only what the text supports keeps the tags useful when Lena later searches by technique. If every phishing report were also tagged T1059 on a guess, a search for script-based activity would return items that never mentioned scripts, and the scenario mapping would show threats CMS has no evidence for.

14.4 The three-line note

Line one: what happened and where. Line two: relevance to CMS with confidence. Line three: recommended action and owner. Busy owners read three lines.

The worked example below follows this three-line pattern exactly, line by line. Line one says what MCX reported and against whom; line two says why it matters to CMS, the shared invoicing supplier, and gives moderate confidence; line three names actions for the email team and the finance manager. A reader who stops after line three still knows what to do.

14.5 Consistency

Lena and her supervisor triage the same ten items monthly and compare decisions, discussing differences.

Ten items a month is small enough to discuss each disagreement. If Lena closes an item her supervisor would have kept, the discussion shows which question they answered differently, often relevance. Over time, the comparison shows whether their decisions are converging, which matters because Lena triages most items alone. They record each disagreement and its resolution in a short table, which becomes a set of worked examples for future triage. When a disagreement turns on a missing rule, such as how to treat vendor blogs, the rule is written down and added to the triage guide.

14.6 Time budget

Triage takes minutes per item. If an item needs more, it moves to analysis with a note explaining why.

A few minutes per item keeps the daily flow moving: MCX alone can send many items in a week. Items that need more, such as a fraud domain that may be linked to others, go to analysis with a sentence saying what question remains. That keeps triage from turning into open-ended research on the first interesting item. Lena records the time each item took, so the monthly table can show whether triage is staying within its budget.

14.7 Logging

Every item, including closed ones, is logged with date, source, decision and reason, so patterns in irrelevant traffic can be spotted and sources tuned.

Logging closed items shows, for example, that a vendor list sends many items about products CMS does not run. That pattern is invisible if only relevant items are recorded. Lena can then ask the vendor to filter, or lower the feed's priority, using the log as evidence rather than impression. The reason field matters most, because a closed item whose reason is blank cannot be reviewed when the same threat returns.

Calibrating with peers

At MCX meetings, analysts from different councils grade the same anonymised item and compare. Differences reveal local habits: one city rates vendor blogs C, another B. Agreeing shared guidance makes grades on shared items mean the same thing to every member, which increases trust in the exchange.

Worked example

Note: "MCX (B2) reports invoice-themed phishing (T1566) against two councils' finance teams this week. Relevant: CMS finance uses the same invoicing supplier; moderate confidence. Action: email team to add sender domains; finance manager to brief staff."

Synthetic case. The report is invented.

Errors and limits

Grades and tags are judgments; record reasons.

Exercises

Synthesis

Triage consistently, grade and tag with reasons, and write short notes owners can act on.

Continue studying — chapter 14 of 30

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →

Worked answers

EX040. Is it relevant, is it timely, is it actionable, and is the source known?

EX041. No. The text describes emails with links (T1566) and says nothing about scripts or interpreters.

EX042. Example: "Public advisory reports exploitation of a permits-software flaw at two cities. Relevant: CMS runs the same version on its portal; high confidence. Action: portal owner to apply the vendor fix by Friday."