Dark › Module 8 › Lesson 2
Context Notes
TI platform literacy — feed ingestion stub, enrichment workflow, false-positive triage, platform search hygiene, export control stub — named platform rows on YOUR `$DW_LAB` fictional org.
Visual · t39_ti_platform_literacy
TI platform = named workflow rows. $DW_LAB. Original Cyberlium.
Opening
TI platforms aggregate and enrich indicators — name workflow rows on YOUR lab org before exporting restricted intel or polluting feeds with unverified dark-web gossip.
TI platform literacy names: feed ingestion stub category, enrichment workflow category, false-positive triage category, platform search hygiene category, and export control stub category. Analyst documents TI platform workflow card on `$DW_LAB` fictional org — five platform rows linked to Module 8-1 STIX handoff — without exporting TLP-RED intel to public channels, without polluting shared feeds with unverified IOCs, without using platform access to hunt stranger employee PII, without marketplace or carding references in platform notes. Cyberlium teaches platform vocabulary on YOUR notes labeled LAB. Refused: feed pollution, unauthorized export, PII hunting via TI tools. Lab row: TI platform workflow card (five rows, triage stub, export control, LAB label).
1. Named platform rows
Feed ingestion, enrichment, false-positive triage, search hygiene, export control — five anchors.
Each row cites `$DW_LAB` fictional org TI workflow — not live employer prod without authorization.
Command guide
Try these commands — Named platform rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MISP — https://www.misp-project.org/ OpenCTI — https://docs.opencti.io/latest/ MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
curl -sS https://www.misp-project.org/ | head -5
cat > "$DW_TI/ti-platform-literacy.txt" <<'EOF'
TI platform literacy:
MISP: sharing events, attributes, galaxies — lab stub import only
OpenCTI: STIX-native knowledge graph — vocabulary for SOC/TI roles
Workflow: alert -> validate -> enrich -> ATT&CK map -> ticket
Lab: FAKE bundle only — never import real criminal marketplace dumps
EOFCommand — copy this
grep -E 'MISP|FAKE|marketplace' "$DW_TI/ti-platform-literacy.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: MISP (https://www.misp-project.org/); OpenCTI (https://docs.opencti.io/latest/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage discipline
False-positive triage stub documented before feed publish — not silent noise injection.
Export control cites TLP from Module 8-1 — same handoff thread.
3. Refused
No feed pollution with unverified IOCs; no TLP-RED public export; no PII hunting via platform.
Platform literacy supports clean intel ops — not rumor spam.
4. What you ship: TI platform workflow card
Five platform rows + triage stub + export control + LAB label + NEVER feed pollution line.
5. What you record before the next lesson
TI platform workflow card path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish unverified dark-web IOCs to shared TI feed without triage as 'platform literacy lab.'
Right
TI platform workflow card from `$DW_LAB` template. Next: Sharing Boundaries.
Mission: TI platform workflow card
1) Name five TI platform literacy rows. 2) Enrichment and triage stub from lab STIX pack. 3) Export control linked to TLP markings. 4) Write NEVER feed pollution line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “False-positive triage — minimum literacy stub?”
Knowledge Check
APPLY: TI platform literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Polluting shared feeds with unverified IOCs is OK.
True or False
Knowledge Check
APPLY: TI platform card includes:
Multiple choice