Lion Cipher Lab
Resolve threat-actor aliases across vendors, and measure what merging fixes (and breaks)
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every quarter someone asks the threat-intel team which actors are hitting our sector most. The honest-looking way to answer is to tag each report with the actor it names and count. The trouble is that the same actor arrives under many names: MITRE ATT&CK's APT29 page lists Cozy Bear, The Dukes, NOBELIUM and Midnight Blizzard among its associated groups, and Microsoft's own naming page maps Midnight Blizzard to NOBELIUM, COZY BEAR, UNC2452 and APT29. Count by name string and the biggest actor gets split into five small bars while an actor with only one name floats to the top. Leadership then…
What you'll learn
- explaining why one threat actor carries many names (each vendor tracks its own cluster, and vendors rename their own schemes) and what that does to any count keyed on a name string
- measuring the damage of naive name counting against a known ground truth: rank error, count error, and whether the #1 bar is right
- building a sourced, date-stamped alias crosswalk (canonical id, name, relationship, source, confidence, added) with a relationship vocabulary that separates 'same' and 'formerly-tracked-as' from 'overlaps'
- normalizing names (case and whitespace) before lookup, and treating any unresolved name as a defect to fix rather than a bar to chart
- demonstrating over-merging: a union-find transitive closure across 'overlaps' rows chains distinct actors into one blob and produces a new, confidently wrong ranking
- keeping a crosswalk alive: re-running against a dated snapshot to show how renames make an old crosswalk silently drop reports, and seeding draft rows from ATT&CK's STIX data without promoting them to 'same'
Steps in this lab
- Why one actor has five names
- Generate a synthetic quarter of reports with a hidden answer key
- Write the tally and the crosswalk, then count naively (BEFORE)
- Read the crosswalk: three relationships, a source and a date on every row
- Merge only on same and formerly-tracked-as (AFTER)
- The honest negative: merge across overlaps and the chart breaks again
- Crosswalks rot: replay an old snapshot and watch reports fall out
- Optional: seed draft rows from ATT&CK's STIX data, without trusting them
- The judgment: when to merge, when to flag, when not to chart at all