Lion Cipher Lab
Build an Indications & Warning matrix so you see it coming
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Almost everything in cyber threat intelligence is about explaining an attack after it has happened. Indications & Warning is the branch that tries to tell you it is coming while there is still time to do something — and it is the oldest, most battle-tested discipline in the whole intelligence profession, because entire wars have turned on whether somebody issued a warning or sat on one. The uncomfortable finding from every post-mortem of every strategic surprise is the same: the information was usually there. Pearl Harbor was not an intelligence blackout; it was a flood of ambiguous signals…
What you'll learn
- using the warning vocabulary precisely: INDICATOR (observable) vs INDICATION (an observed indicator that means something) vs WARNING (the judgement you issue)
- building a six-column Indications & Warning (I&W) matrix as a real file, not a thought experiment
- deriving indicators from adversary BEHAVIOUR rather than from a feed of IP addresses
- killing bad indicators with the three tests: OBSERVABILITY, SPECIFICITY and DIAGNOSTICITY
- spotting the non-diagnostic indicator — one that fires just as hard under the innocent explanation — and deleting it on the record
- setting warning THRESHOLDS with the two-sided cost in mind: crying wolf burns credibility, a threshold set too high buys you surprise
- avoiding the standing-warning trap, where an indicator that has been amber for a year becomes furniture instead of warning
- writing a warning statement as a judgement under uncertainty, with explicit confidence language
- handing off every surviving indicator as either a collection requirement (CR) or a detection rule (DR), which is how a matrix becomes a control
- pre-agreeing the ACTION per threshold with the person who has to take it, and scheduling the review that retires dead indicators
Steps in this lab
- Three words that are not synonyms: indicator, indication, warning
- What an I&W matrix is — and the one situation where you should NOT build one
- Why this, not a threat feed: the matrix names the decision in advance
- The scenario — and the innocent explanation you must beat
- Make the file — this is a real artifact, not a thought experiment
- Column by column, with the first row worked longhand
- Draft rows 2 to 10 — derive indicators from behaviour, not from a feed
- The three tests that kill bad indicators
- The heart of the lab: delete the rows that fail
- Thresholds, the two-sided cost, and the standing-warning trap
- Warning is a judgement under uncertainty — so write it like one
- The handoff: turn every surviving row into a CR or a DR
- What you actually built