Lion Cipher Lab
Build a threat profile from public reporting
- Threat Intel Analyst
- Beginner
- ~40 min
- Free · no account required
Why it matters
Threat intelligence is only useful when it changes what you defend and how. A pile of news articles about a hacking group tells you little; a structured profile — who they target, how they operate, which techniques they favour, and therefore what you should watch for — tells you exactly where to spend defensive effort. Learning to turn scattered public reporting into that structured profile is core threat-intel work, and it's entirely doable from open sources: MITRE ATT&CK maintains catalogued profiles of known adversary groups, and government agencies publish detailed advisories on active…
What you'll learn
- structuring intel about an adversary
- using MITRE ATT&CK Groups as a source
- reading government threat advisories
- mapping a group's techniques to ATT&CK
- turning a profile into defensive actions
Steps in this lab
- What a threat profile is (and what it's for)
- Start from the MITRE ATT&CK Groups catalogue
- Add government advisories for depth and currency
- Structure the profile
- Map their techniques to ATT&CK — and to your defences
- State your confidence and keep it current
- Why structure is what makes intel useful