Lion Cipher Lab
Turn intelligence into action with the F3EAD cycle (Find, Fix, Finish, Exploit, Analyze, Disseminate)
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Most teams are good at collecting threat intelligence and bad at USING it. Reports pile up, feeds scroll past, and the adversary keeps working — because knowing about a threat and doing something about it are two different muscles, and the second one rarely gets trained. F3EAD is the muscle for the second. It came out of military special operations, where intelligence had to drive action in hours not weeks, and it was adapted for cyber precisely because incident response has the same problem: you cannot afford a slow, linear 'collect, then analyze, then maybe act' pipeline when a C2 channel…
What you'll learn
- walking a real intrusion through all six F3EAD phases: Find, Fix, Finish, Exploit, Analyze, Disseminate
- operationalizing threat intelligence — turning a finished intel product into a concrete defensive action
- writing a target package that scopes a threat from your priority intelligence requirements (PIRs)
- confirming (FIXing) an indicator in your own environment before you act on it
- harvesting new IOCs and TTPs from an incident response during EXPLOIT — the phase most teams skip
- fusing exploited artifacts with prior intelligence and mapping behaviour to MITRE ATT&CK in ANALYZE
- disseminating finished intelligence into SOC detections, a leadership brief, and a sharing community
- judging when F3EAD's fast operations-led loop fits and when the slower traditional intelligence cycle fits instead
Steps in this lab
- The problem F3EAD solves: intel that never becomes action
- The six phases in plain language
- Why F3EAD, not the traditional intelligence cycle? (the judgment)
- The scenario: a phishing email at Finch & Vale Logistics
- FIND — scope the target and write a target package
- FIX — confirm the target is really in your environment
- FINISH — take the defensive action
- EXPLOIT — harvest the intelligence (the phase everyone skips)
- ANALYZE — fuse the harvest with what you already knew
- DISSEMINATE — push finished intelligence to the people who act, and close the loop
- When NOT to use it, the trap to avoid, and doing it yourself