Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
Insider Threat
Credential / API Token: Data Point Intelligence Guide
An exposed credential is not a curiosity to explore. It is an incident with a clock running, and the only...
Court Case / Docket: Data Point Intelligence Guide
Court records are the only open dataset where an adversary is compelled to describe their own conduct under oath. Analysts...
File / Document: Data Point Intelligence Guide
Every file carries more than its content. The container, the metadata and the structure record how it was made and...
Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
Person / Name: Data Point Intelligence Guide
A name is the weakest identifier in intelligence work and the one most likely to end a career when handled...
Legal Intelligence (LEGINT): Intelligence Discipline Guide
Litigation is an involuntary disclosure engine. Adversaries in court say, under oath and on the public record, what they will...
Criminal Intelligence (CRIMINT): Intelligence Discipline Guide
Criminal intelligence is not case notes with better formatting. It is the discipline that turns scattered incidents into an articulable...
Identity Intelligence (IDENT): Intelligence Discipline Guide
Identity resolution fails in two directions and only one of them is visible. A missed link costs you the investigation;...
