Lion Cipher Lab
Catch circular reporting before it inflates your confidence (rebuild who copied whom)
- Threat Intel Analyst
- Advanced
- ~90 min
- Free · no account required
Why it matters
When eleven vendor blogs, feeds and digests all say the same group is behind an intrusion, it feels like overwhelming agreement. Often it is one original investigation, copied, re-blogged, aggregated and copied again, sometimes without a single citation. Count the copies as confirmation and your confidence climbs while your evidence stays flat; worse, anyone who can plant one claim in one widely-read source can manufacture a consensus for free. Intelligence standards have warned about this for decades, and commercial threat intelligence makes it easier, because publishing is cheap and…
What you'll learn
- Telling apparent corroboration (how many reports say it) from independent corroboration (how many original sources stand behind it)
- Building a citation graph from a reporting corpus and resolving every report to its root sources
- Normalizing (refanging) indicators before comparing reports, and measuring what skipping that step costs
- Detecting uncited copying from indicator-set overlap and publication order, and grading that detection against ground truth
- Reading a threshold sweep as a trade-off between false merges and missed copies instead of hunting for a magic number
- Writing an ICD 206-style source summary statement that reports a defensible range rather than a single inflated count
Steps in this lab
- The trap: eleven reports, how many sources?
- What the analytic standards ask of you
- Open a terminal, check Python, make a folder
- Build the corpus, with the answer key hidden in a separate file
- Write the shared helpers: refang, compare, resolve to roots
- Count what the citations admit to
- Refang before you compare, or copies hide in plain sight
- Sweep the threshold and grade it against the hidden truth
- Ship a policy, not a threshold: auto-merge, review band, unknown
- Resolve the grey band the way an analyst would
- The honest limits of this method
- When to do this, why it works, and how a pro does it better