📕
Threat Intelligence Manual
  • Introduction
  • Contents
  • Module 1: Introduction to Cyber Threat Intelligence
    • Definition and Importance of CTI
    • Threat Intelligence Lifecycle
    • Key Concepts: Indicators, TTPs, IOCs and More
    • Role of CTI in Cybersecurity
  • Module 2: Data Sources and Collection
    • Open Source Intelligence (OSINT) Sources
    • Technical Intelligence (TECHINT) Sources
    • Human Intelligence (HUMINT) Sources
    • Data Collection Techniques and Tools
    • Legal and Ethical Considerations
  • Module 3: Data Processing and Analysis
    • Structuring and Enriching Threat Intelligence Data
    • Indicator Analysis Techniques
    • Malware Analysis Fundamentals
    • Network and Host Artifact Analysis
    • Data Mining and Machine Learning for Threat Analysis
  • Module 4: Threat Modeling and Actor Profiling
    • Adversary Models and Frameworks
    • Tactics, Techniques and Procedures
    • Threat Actor Groups and Motivations
    • Attack Vector Analysis
  • Module 5: Cyber Threat Intelligence Analytics
    • Structured and Unstructured Data Analysis
    • Statistical and Visualization Techniques
    • Reporting and Presentation of Findings
  • Module 6: Threat Intelligence Sharing
    • Standards and Frameworks
    • Threat Intelligence Platforms and Tools
    • Information Sharing Communities
    • Trust Groups and Sharing Protocols
  • Module 7: Building a CTI Program
    • Developing a CTI Strategy and Roadmap
    • Roles and Responsibilities in a CTI Team
    • Integration with Security Operations
    • Measuring CTI Effectiveness and Metrics
  • Module 8: Operationalizing CTI
    • CTI Program Maturity Assessment
    • CTI Workflow Automation and Orchestration
    • CTI Playbooks and Runbooks
    • CTI-driven Threat Hunting Exercises
    • CTI Integration with Security Tools and Systems
Powered by GitBook
On this page
  1. Module 2: Data Sources and Collection

Open Source Intelligence (OSINT) Sources

OSINT refers to the collection and analysis of publicly available data and information from various open sources to gather intelligence about potential cyber threats. OSINT sources can provide valuable insights into threat actors, their tactics, techniques, and procedures (TTPs), as well as indicators of compromise (IoCs) and other relevant threat data.

Here are some common OSINT sources for cyber threat intelligence:

  1. Security Researcher Blogs and Reports: Many security researchers, analysts, and organizations publish blogs, reports, and advisories detailing their findings on new threats, vulnerabilities, and threat actor activities. Examples include SANS Internet Storm Center, Krebs on Security, and reports from cybersecurity companies like Mandiant, FireEye, and Crowdstrike.

  2. Social Media: Social media platforms like Twitter, Reddit, and cybersecurity-focused forums can be valuable sources of OSINT. Threat actors and researchers often share information, indicators, and discussions about emerging threats or ongoing cyber incidents.

  3. Code Repositories and Paste Sites: Platforms like GitHub, Pastebin, and other code-sharing sites can sometimes contain malicious code samples, exploits, or discussions related to cyber threats. Analysts can monitor these sites for potential indicators of new threats or attack techniques.

  4. Hacker Forums and Marketplaces: While accessing these forums may raise legal and ethical concerns, they can provide insights into the activities, motivations, and techniques of threat actors. However, caution and proper legal guidelines should be followed when considering these sources.

  5. News and Media Reports: Mainstream news outlets, cybersecurity publications, and industry magazines can report on significant cyber incidents, data breaches, or new threat actor campaigns, providing valuable context and details for threat intelligence purposes.

  6. Government and Industry Reports: Various government agencies, such as CISA (Cybersecurity and Infrastructure Security Agency), and industry organizations like MITRE and FIRST, publish reports, advisories, and threat intelligence data that can be leveraged as OSINT sources.

  7. Internet Scanning and Monitoring: Tools and techniques like internet scanning, honeypots, and monitoring services can help identify and collect data on potentially malicious infrastructure, command-and-control servers, or other cyber threat indicators.

When leveraging OSINT sources, it's important to verify the credibility and reliability of the information, as well as ensure compliance with legal and ethical guidelines. OSINT data can be combined with other intelligence sources to provide a more comprehensive understanding of cyber threats and enable effective threat analysis and mitigation strategies.

PreviousRole of CTI in CybersecurityNextTechnical Intelligence (TECHINT) Sources

Last updated 1 year ago