Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
Threat Analysis
Keyword / Narrative: Data Point Intelligence Guide
A keyword is a hypothesis about language. Track the wrong string and you will measure nothing at all, very confidently....
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
News Intelligence (NEWSINT): Intelligence Discipline Guide
Reporting is evidence of what was published, by whom, when and sourced how. Treated that way it is one of...
Risk Intelligence (RISKINT): Intelligence Discipline Guide
Risk intelligence is what stops a briefing ending with it depends. It converts what you know, and what you do...
Open Source Intelligence (OSINT): Intelligence Discipline Guide
Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
