Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
Nation State
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
SSL/TLS Certificate: Data Point Intelligence Guide
Adversaries change domains and IPs constantly. They reuse certificate configuration because it is tedious not to. That asymmetry makes the...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Signals Intelligence (SIGINT): Intelligence Discipline Guide
Signals intelligence is a state function with a warrant behind it. For everyone else, the discipline still matters, because you...
Technical Intelligence (TECHINT): Intelligence Discipline Guide
Every device carries a confession: certification filings, component markings, firmware strings and design choices. Technical intelligence reads that confession to...
Disinformation Intelligence (DISINFOINT): Intelligence Discipline Guide
The finding is rarely that a claim is false. It is that a set of accounts, sites and outlets behaved...
Government Intelligence (GOVINT): Intelligence Discipline Guide
Decisions are made by named people, in named bodies, under written procedures. Government intelligence is knowing which body, which person...
Geospatial Intelligence (GEOINT): Intelligence Discipline Guide
Place is the one attribute nearly every other data point carries. Geospatial intelligence makes place answer questions: what is here,...
Open Source Intelligence (OSINT): Intelligence Discipline Guide
Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
Election Security & PSYOP: Mission Domain Intelligence Guide
The claim that the count was rigged was already trending three weeks before polls opened. The infrastructure held perfectly. The...
RF & Signals Intel: Mission Domain Intelligence Guide
Aircraft over a whole region started reporting navigation integrity failures within the same hour. No one announced anything. The spectrum...
Space & Satellite Intel: Mission Domain Intelligence Guide
A satellite manoeuvred twice in one week and ended up station-keeping four kilometres from another operator's communications bird. Nothing was...
Transnational Repression: Mission Domain Intelligence Guide
A dissident's family is visited at home, an INTERPOL notice appears, and a spyware link arrives by messenger, all within...
Military & Defense: Mission Domain Intelligence Guide
Order of battle used to be a classified product. Now a unit's deployment is visible from insignia in a soldier's...
WMD / Proliferation: Mission Domain Intelligence Guide
Proliferation networks do not buy weapons. They buy vacuum pumps, maraging steel, frequency converters and flow-forming machines, each individually unremarkable...
Economic Espionage: Mission Domain Intelligence Guide
Industrial espionage rarely looks like a break-in. It looks like a departing researcher, a joint venture with an unusual data...
Sanctions Evasion: Mission Domain Intelligence Guide
Sanctions evasion leaves a documentary shadow: a new intermediary in a familiar corridor, a vessel that stops transmitting for eleven...
