Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
IP Address
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Critical Infrastructure: Mission Domain Intelligence Guide
In an office network the worst outcome is data loss. On a substation or a water treatment line the worst...
Threat Analysis: Mission Domain Intelligence Guide
An indicator list is not intelligence. Intelligence is a judgement, held to a stated confidence, that changes what a decision-maker...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
Nation State: Mission Domain Intelligence Guide
State activity rarely arrives labelled. It surfaces as a procurement order routed through a third-country freight forwarder, a research institute...
