Keyword / Narrative: Data Point Intelligence Guide
A keyword is a hypothesis about language. Track the wrong string and you will measure nothing at all, very confidently....
Open Source Intelligence
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Risk Intelligence (RISKINT): Intelligence Discipline Guide
Risk intelligence is what stops a briefing ending with it depends. It converts what you know, and what you do...
Reference Intelligence (REFINT): Intelligence Discipline Guide
Most wrong conclusions can be traced back to two records an analyst believed were about the same thing. Reference intelligence...
Open Source Intelligence (OSINT): Intelligence Discipline Guide
Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline...
Risk Analysis: Mission Domain Intelligence Guide
The evacuation decision was made three days after the intelligence supported it. Nobody lacked information. What was missing was a...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
