Lion Cipher Lab
Pivot threat intelligence as a graph in Neo4j
- Threat Intel Analyst
- Advanced
- ~75 min
- Free · no account required
Why it matters
A flat spreadsheet of indicators can tell you 'this domain is bad,' but it cannot answer the question every real investigation asks next: 'what else is connected to this?' Threat intelligence is naturally a graph -- things (a domain, a malware family, an actor) linked by relationships (this indicator INDICATES that malware; this intrusion-set USES it). Loading intel into a graph database and pivoting across those edges is the core tradecraft of infrastructure and attribution analysis. Once you can traverse from one IOC to everything it touches, you stop reading intel and start hunting through…
What you'll learn
- STIX 2.1 structure: SDOs vs SROs
- Modeling threat intel as a property graph (nodes and edges)
- Running Neo4j locally in Docker
- Loading a STIX bundle with the neo4j Python driver (MERGE by id)
- Cypher pivot queries and variable-length path traversal
- Attribution judgment: the over-clustering trap and edge provenance
Steps in this lab
- Why intel is a graph, not a spreadsheet
- Run Neo4j in Docker
- Build a small STIX 2.1 bundle you can actually read
- Load the bundle into Neo4j (MERGE by STIX id)
- Pivot with Cypher
- The judgment: when the graph lies to you