Lion Cipher Lab
Map an adversary's relationships with link analysis
- Threat Intel Analyst
- Beginner
- ~45 min
- Free · no account required
Why it matters
Threat intelligence arrives as scattered facts: this actor ran that campaign, that campaign used this domain, the domain resolves to that netblock, and a second crew has been seen using the same malware. Written out as a list, those facts stay disconnected and the shape of the operation stays hidden. Drawn as a graph, the same facts snap into a picture — and one node usually turns out to be the piece everything else depends on. Link analysis is the core analytic move behind the professional intelligence platforms (Maltego, OpenCTI, MISP) that a SOC or CTI team lives in, and doing it by hand…
What you'll learn
- modelling adversary data as a graph (nodes, edges, entity types)
- building an interactive link chart with networkx and pyvis
- pivoting from one indicator to every entity it touches
- using degree and betweenness centrality to find the hub of an operation
- reading a graph critically: a link is a hypothesis, correlation is not attribution
Steps in this lab
- What link analysis is, and why adversaries have a shape
- Set up: two Python libraries, fully offline after install
- Build the graph: nodes are entities, edges are relationships
- Render it: an interactive link chart on your own disk
- Pivot: from one indicator to everything it touches
- Find the hub: degree and betweenness centrality
- The honest caveat: a link is a hypothesis, not proof
- Where this goes next, and why the reps matter