Module 7: Threat Intelligence — Know Your Enemy
Don't investigate blind. Use intel to move faster and smarter.
7 lessons · 6 labs
Enrich attacker IOCs (185.220.101.42, darknet.example domains) in MISP and connect them to Operation APT Breach.
Path
- Lesson01
IOC Types & Lifecycle
IPs, domains, hashes, freshness
- Lab02Intermediate
Lab 7.1 — IOC Lookup
Search 5 IOCs in MISP.
- Lesson03
MISP for SOC Analysts
Events, attributes, tags
- Lab04Intermediate
Lab 7.2 — Feed the SIEM
3 IOCs from MISP. Search Wazuh.
- Lesson05
Threat Feeds & Sharing
Open feeds, ISACs, TLP
- Lab06Advanced
Lab 7.3 — Pivot and Expand
IP → MISP → Wazuh → threat profile.
- Lesson07
Pivoting: From One IOC to Many
IP → domain → hash → campaign
- Lab08Advanced
Lab 7.4 — Campaign Mapping
Extract IOCs from an Operation Front Door flash alert, search MISP for matches, map ATT&CK techniques, and write an executive 'Are We Affected?' briefing.
- Lesson09
Intel-Driven Triage
IOCs change triage decisions
- Lab10Advanced
Lab 7.5 — Threat Report to Hunt Plan
Given a simulated APT report: extract IOCs, map to ATT&CK, create MISP event, build hunt hypothesis document.
- Lesson11
Operationalizing Threat Reports
From reading a threat report to building detections — extract attack steps, map to ATT&CK, identify artifacts, map to evidence sources
- Lesson12
OSINT for SOC Analysts
Free OSINT tools (VirusTotal, AbuseIPDB, Shodan, URLScan.io, WHOIS), the 5-step investigation workflow, reading results, OPSEC
- Lab13Intermediate
Lab 7.6 — OSINT Investigation
Browser-only: Investigate 5 IOCs across free OSINT platforms (VirusTotal, AbuseIPDB, Shodan, URLScan.io, WHOIS). Produce a structured OSINT report.