Threat intelligence and OSINT
Everything I've written on threat intelligence and osint, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
When Should a SOC Block an IP Address From a Threat Feed?
Decide when a threat-feed IP deserves blocking: assess source independence, freshness, shared-address risk, local evidence, scope and rollback.
-
Adversary infrastructure
I would not begin adversary infrastructure by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
Counterintelligence
I would not begin counterintelligence by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Deception operations
I would not begin deception operations by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Indicator lifecycle
I would not begin indicator lifecycle by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Intelligence briefings
I would not begin intelligence briefings by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Intelligence collection planning
I would not begin intelligence collection planning by buying another platform or launching a large programme. I would find the boundary, the accountable owne...
-
OSINT verification
I would not begin OSINT verification by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Source reliability
I would not begin source reliability by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Threat actor attribution
I would not begin threat actor attribution by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
Threat intelligence requirements
I would not begin threat intelligence requirements by buying another platform or launching a large programme. I would find the boundary, the accountable owne...
-
What attackers learn from your job adverts
A job advert for a security engineer that lists your SIEM, your EDR, your cloud provider and your identity platform is a map. Attackers read them.
Nothing matches. Try another word, or ask me directly.