Citizen Lab: Intelligence Source Guide
The Citizen Lab at the University of Toronto publishes forensic investigations into mercenary spyware, censorship and app surveillance, usually with...
Domain Name
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
DNS Record: Data Point Intelligence Guide
DNS records are an organisation's architecture diagram, published voluntarily and updated in real time. Most defenders never read their own....
Wi-Fi BSSID: Data Point Intelligence Guide
A wireless access point shouts its identifier several times a second, and crowdsourced databases have been listening for years. A...
MAC Address: Data Point Intelligence Guide
A MAC address is the closest thing to a serial number that a network interface broadcasts for free. It is...
IP Range / CIDR: Data Point Intelligence Guide
Individual IPs rotate hourly. The block they come from does not. CIDR is the level at which infrastructure ownership actually...
Subdomain: Data Point Intelligence Guide
Organisations defend the domain they advertise and forget the hundred hostnames beneath it. Subdomain enumeration is where the real attack...
ASN: Data Point Intelligence Guide
The ASN is where infrastructure stops being anonymous. Every packet on the public internet is routed by an organisation that...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Signals Intelligence (SIGINT): Intelligence Discipline Guide
Signals intelligence is a state function with a warrant behind it. For everyone else, the discipline still matters, because you...
News Intelligence (NEWSINT): Intelligence Discipline Guide
Reporting is evidence of what was published, by whom, when and sourced how. Treated that way it is one of...
Disinformation Intelligence (DISINFOINT): Intelligence Discipline Guide
The finding is rarely that a claim is false. It is that a set of accounts, sites and outlets behaved...
Email Intelligence (EMAILINT): Intelligence Discipline Guide
An email address is three things at once: an identifier, a routing instruction and a piece of infrastructure history. Email...
Government Intelligence (GOVINT): Intelligence Discipline Guide
Decisions are made by named people, in named bodies, under written procedures. Government intelligence is knowing which body, which person...
Election Intelligence (ELECTINT): Intelligence Discipline Guide
An election is the most predictable high-risk event on any calendar: fixed date, known actors, published rules. Election intelligence is...
Open Source Intelligence (OSINT): Intelligence Discipline Guide
Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline...
Cryptocurrency Intelligence (CRYPTINT): Intelligence Discipline Guide
Public blockchains keep a permanent, complete record of every transfer. The hard part was never the data. It is knowing...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
