Context Notes
TI platform literacy — feed ingestion stub, enrichment workflow, false-positive triage, platform search hygiene, export control stub — named platform rows on YOUR `$DW_LAB` fictional org.
Visual · t39_ti_platform_literacy
TI platform = named workflow rows. $DW_LAB. Original Cyberlium.
TI platforms aggregate and enrich indicators — name workflow rows on YOUR lab org before exporting restricted intel or polluting feeds with unverified dark-web gossip.
TI platform literacy names: feed ingestion stub category, enrichment workflow category, false-positive triage category, platform search hygiene category, and export control stub category. Analyst documents TI platform workflow card on `$DW_LAB` fictional org — five platform rows linked to Module 8-1 STIX handoff — without exporting TLP-RED intel to public channels, without polluting shared feeds with unverified IOCs, without using platform access to hunt stranger employee PII, without marketplace or carding references in platform notes. Cyberlium teaches platform vocabulary on YOUR notes labeled LAB. Refused: feed pollution, unauthorized export, PII hunting via TI tools. Lab row: TI platform workflow card (five rows, triage stub, export control, LAB label).
1. Named platform rows
Feed ingestion, enrichment, false-positive triage, search hygiene, export control — five anchors.
Each row cites `$DW_LAB` fictional org TI workflow — not live employer prod without authorization.
Command guide
Try these commands — Named platform rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: MISP (https://www.misp-project.org/); OpenCTI (https://docs.opencti.io/latest/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage discipline
False-positive triage stub documented before feed publish — not silent noise injection.
Export control cites TLP from Module 8-1 — same handoff thread.
3. Refused
No feed pollution with unverified IOCs; no TLP-RED public export; no PII hunting via platform.
Platform literacy supports clean intel ops — not rumor spam.
4. What you ship: TI platform workflow card
Five platform rows + triage stub + export control + LAB label + NEVER feed pollution line.
5. What you record before the next lesson
TI platform workflow card path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Publish unverified dark-web IOCs to shared TI feed without triage as 'platform literacy lab.'
- Right: TI platform workflow card from `$DW_LAB` template. Next: Sharing Boundaries.
Mission: TI platform workflow card
1) Name five TI platform literacy rows. 2) Enrichment and triage stub from lab STIX pack. 3) Export control linked to TLP markings. 4) Write NEVER feed pollution line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “False-positive triage — minimum literacy stub?”
APPLY: TI platform literacy uses:
APPLY: True or False: Polluting shared feeds with unverified IOCs is OK.
APPLY: TI platform card includes: