Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
Ransomware
Detection Signature: Data Point Intelligence Guide
A detection signature is intelligence written in executable form. Read as a document, it tells you exactly what its author...
Cryptocurrency Address: Data Point Intelligence Guide
A blockchain address is a pseudonymous account with a permanent, public and complete transaction history. That combination makes it the...
Onion / Hidden Service: Data Point Intelligence Guide
An onion address is a public key, not a location. Everything you can learn about a hidden service comes from...
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Criminal Intelligence (CRIMINT): Intelligence Discipline Guide
Criminal intelligence is not case notes with better formatting. It is the discipline that turns scattered incidents into an articulable...
Cryptocurrency Intelligence (CRYPTINT): Intelligence Discipline Guide
Public blockchains keep a permanent, complete record of every transfer. The hard part was never the data. It is knowing...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Healthcare & Drug Security: Mission Domain Intelligence Guide
A hospital that cannot access its imaging system diverts ambulances. A falsified antimalarial with no active ingredient kills quietly, one...
Critical Infrastructure: Mission Domain Intelligence Guide
In an office network the worst outcome is data loss. On a substation or a water treatment line the worst...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
Dark Web Intel: Mission Domain Intelligence Guide
Most of what is posted on a criminal forum is advertising. The intelligence value is not in the claim but...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
