This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
An indicator is a lead, not a licence
Threat intelligence, for an admin, is a source you trust and a list of indicators you are allowed to hold: a hash, a domain, an address, a technique name. You use it to ask whether your own logs already show that thing. You do not use it to scan the internet, to download malware, or to try the technique.
MITRE ATT&CK is a vocabulary. The lookup on this site names a technique so a detection can say what it is looking for. A technique page is not a set of instructions for you to carry out. The detection guide is where the rule lives.
An IOC extractor pulls indicators out of text you paste. Paste a report you are allowed to keep. Do not paste a live secret, and do not paste something you were not given. An extracted address is a candidate. It is not automatically a block.
Blocking a shared address can break a service you need. Write the reason, the expiry, and the owner. A block with no expiry becomes folklore.
One report, one indicator, one question of your logs
Take a short report you are allowed to hold. Extract one indicator with the tool, or by reading. Write what it is. Search the logs you already collect for that indicator. The result is either a hit you turn into an incident, or a miss you record. Both are finished answers.
If you block, block on a control you administer, with an expiry. The lab uses a documentation address such as 203.0.113.10 so you can practise the ticket without touching a real correspondent. Replace it before any production control.
Map the story to a technique name if it helps the detection owner. Stop there. Do not reproduce the procedure.
Share onward only what your policy allows. A raw report with personal data is the privacy guide's problem before it is a forwarded email.
A change you can finish
The change is a dated block or a detection request, each with an owner. Reading a report is not a change.
Rollback of a block is the removal you wrote down at the start.
- Name the source and confirm you may hold the text.
- Extract one indicator. Remove any secret first.
- Search logs you already have.
- Record hit or miss.
- If you block, set an expiry and an owner.
- Use a documentation address in the lab.
- Hand a real hit to the incident guide.
Mistakes that outlive the command
threat intelligence fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.
- Scanning the internet for an indicator.
- Downloading malware to obtain a hash.
- Treating ATT&CK as instructions.
- A permanent block of a shared service.
- Pasting secrets into the extractor.
- Forwarding a report that contains personal data without a reason.
- A hit with no incident owner.
- A lab address left in a production block list.
Decisions to write down before the window
Decision 1 for threat intelligence. The source is named and you may hold it. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 2 for threat intelligence. Indicators are searched in your logs, not used to probe other networks. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 3 for threat intelligence. A block has an expiry and an owner. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 4 for threat intelligence. Technique names label detections. They do not become exercises. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 5 for threat intelligence. Secrets are removed before any paste. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 6 for threat intelligence. A hit becomes an incident or a written miss. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 7 for threat intelligence. The lab address is documentation-only. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 8 for threat intelligence. Personal data in a report follows the privacy guide. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 9 for threat intelligence. The detection guide owns any new rule. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 10 for threat intelligence. Rollback of a block is removal. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
The hour you stop
Write the hostname or the system name, the owner, and the clock time before you change anything for threat intelligence. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.
Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.
prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.
One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.
A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.
Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.
Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.
Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.
If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.
When the checks pass, the next system waits until someone else can repeat the proof from the notes. threat intelligence is done for this window when the proof is written, not when the tool printed a file.
This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.
Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.
Threat-intelligence checks before an indicator becomes a control
Check 1 in Threat-intelligence checks before an indicator becomes a control. The source is written down. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 2 in Threat-intelligence checks before an indicator becomes a control. You are allowed to hold the text. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 3 in Threat-intelligence checks before an indicator becomes a control. No secret was pasted into the tool. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 4 in Threat-intelligence checks before an indicator becomes a control. The log search used data you already collect. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 5 in Threat-intelligence checks before an indicator becomes a control. Hit or miss is recorded. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 6 in Threat-intelligence checks before an indicator becomes a control. Any block has an expiry. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 7 in Threat-intelligence checks before an indicator becomes a control. 203.0.113.10 or any other documentation address is not in production. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 8 in Threat-intelligence checks before an indicator becomes a control. No scan and no malware download was part of the work. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 9 in Threat-intelligence checks before an indicator becomes a control. A technique name was not turned into steps. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 10 in Threat-intelligence checks before an indicator becomes a control. A second person read the indicator and the expiry. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 11 in Threat-intelligence checks before an indicator becomes a control. The incident guide has the hit if there was one. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 12 in Threat-intelligence checks before an indicator becomes a control. The previous allow state is the rollback. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 13 in Threat-intelligence checks before an indicator becomes a control. The hostname in the prompt matches the hostname in the ticket for threat intelligence. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 14 in Threat-intelligence checks before an indicator becomes a control. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 15 in Threat-intelligence checks before an indicator becomes a control. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 16 in Threat-intelligence checks before an indicator becomes a control. Done is a sentence a second person can repeat: the proof for threat intelligence happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.