Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
Cyber Intelligence
Keyword / Narrative: Data Point Intelligence Guide
A keyword is a hypothesis about language. Track the wrong string and you will measure nothing at all, very confidently....
Software Package: Data Point Intelligence Guide
You do not audit the code you install. You audit, at best, the top of a dependency tree whose depth...
Code Repository: Data Point Intelligence Guide
A repository is an organisational confession: who builds what, on which infrastructure, with which mistakes, timestamped to the minute. Understanding...
Credential / API Token: Data Point Intelligence Guide
An exposed credential is not a curiosity to explore. It is an incident with a clock running, and the only...
Detection Signature: Data Point Intelligence Guide
A detection signature is intelligence written in executable form. Read as a document, it tells you exactly what its author...
Cryptocurrency Address: Data Point Intelligence Guide
A blockchain address is a pseudonymous account with a permanent, public and complete transaction history. That combination makes it the...
Patent: Data Point Intelligence Guide
Patents are the one place where organisations are legally required to describe their capabilities in detail, name the engineers who...
Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
Data Breach: Data Point Intelligence Guide
A breach is not a single event, it is a dataset with a life of its own. The incident ends...
Onion / Hidden Service: Data Point Intelligence Guide
An onion address is a public key, not a location. Everything you can learn about a hidden service comes from...
File / Document: Data Point Intelligence Guide
Every file carries more than its content. The container, the metadata and the structure record how it was made and...
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
SSL/TLS Certificate: Data Point Intelligence Guide
Adversaries change domains and IPs constantly. They reuse certificate configuration because it is tedious not to. That asymmetry makes the...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
Device / Advertising ID: Data Point Intelligence Guide
An advertising identifier was designed to be a resettable, privacy-preserving marketing token. In practice it became one of the most...
Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
Person / Name: Data Point Intelligence Guide
A name is the weakest identifier in intelligence work and the one most likely to end a career when handled...
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
Subdomain: Data Point Intelligence Guide
Organisations defend the domain they advertise and forget the hundred hostnames beneath it. Subdomain enumeration is where the real attack...
ASN: Data Point Intelligence Guide
The ASN is where infrastructure stops being anonymous. Every packet on the public internet is routed by an organisation that...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
