Lion Cipher Lab
Capstone: produce a finished-intelligence report on a threat actor
- Threat Intel Analyst
- Advanced
- ~3-4 hours
- Free · no account required
Why it matters
Frameworks are not the job. Producing a finished product a defender or a decision-maker can actually act on is the job. An analyst who can run ATT&CK and the Diamond Model but cannot write a clear, sourced, confidence-tagged judgment produces nothing usable — just diagrams. This capstone is the single most portable thing in the whole track: the ability to take messy public reporting on a real adversary and turn it into a professional intelligence product with key judgments, an ATT&CK-mapped TTP section, IOCs, and honest analyst comments. It is exactly what a threat-intel role, a SOC lead, or…
What you'll learn
- Finished-intelligence writing
- Key judgments with analytic confidence
- Estimative language (ICD 203)
- ATT&CK-mapped TTP reporting
- Analysis of Competing Hypotheses for attribution
- Sourcing and confidence discipline
- Synthesizing OSINT, Diamond Model, and IOC pivots into one product
Steps in this lab
- What a finished-intelligence product actually is
- Pick a real, well-documented actor
- Gather evidence — and record its provenance as you go
- Test your attribution with ACH before you commit it
- Learn the confidence vocabulary — and use it precisely
- Write the Key Judgments — the part everyone reads
- Build the ATT&CK-mapped TTP section
- IOCs and analyst comments — including what you don't know
- Assemble, self-review against the standard, and ship it