Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Threat Actor Intelligence
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
Extremism & Radicalization: Mission Domain Intelligence Guide
Radicalisation is not a conveyor belt. It is a set of grievances, communities and content economies, and most of what...
Counter-Terrorism: Mission Domain Intelligence Guide
Attack planning leaves a logistics trail before it leaves an ideological one: a rented van, a chemical purchase, a reconnaissance...
