Lion Cipher Lab
Run a structured OSINT investigation (the intelligence cycle, ethically)
- Threat Intel Analyst
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Anyone can paste a domain into a lookup tool. What makes an OSINT analyst is method and restraint: asking a sharp question first, collecting only from public sources, verifying before believing, writing it down with sources — and never crossing the line into interacting with, deceiving, or harassing the target. Investigations that skip the discipline produce confident nonsense; investigations that skip the ethics get people hurt and get the investigator in legal trouble. This lab gives you the repeatable, defensible process real analysts, journalists, and threat-intel teams use.
What you'll learn
- running the intelligence cycle (define, collect, process, analyse, disseminate) end to end
- writing a scoped intelligence question and rules of engagement before you touch a source
- collecting only from passive, public sources — WHOIS, DNS, certificate transparency, the public web
- avoiding contamination: never logging in to, probing, or contacting the target
- verifying and cross-referencing findings across at least two independent sources
- documenting findings with a source, a timestamp, and an honest confidence level
- knowing exactly where the legal and ethical line is — and stopping at it
Steps in this lab
- First, the one rule — read this before anything else
- The map you'll follow: the intelligence cycle
- Stage 1 — Define the question and your rules of engagement
- Stage 2 — Collect, from public sources only
- The contamination rule — why you stay hands-off
- Stage 3 & 4 — Verify, cross-reference, then analyse
- Stage 5 — Document it as a sourced mini-report
- Know where the line is — and stop at it