Threat › Module 9 › Lesson 2
TI Reports
TI report literacy — BLUF, audience, scope, limitations — structure rows on `$TI_LAB` report stub only.
Visual · t33_ti_reports
TI reports = named report structure rows. $TI_LAB. Original Cyberlium.
Opening
Stakeholders read reports not raw notes — name TI report sections on YOUR lab stub before emailing prod leadership without RoE.
TI report literacy names: BLUF/bottom line category, audience tailoring (SOC vs exec literacy stub), scope and methodology section, findings with ATT&CK link category, limitations and confidence summary category, and recommendations separated from analysis category. Analyst drafts TI report outline on `$TI_LAB` — maps seven sections to Module 9-1 analysis notes stub — without prod case paste without RoE, without report as marketplace IOC dump, without recommendations that imply unauthorized offensive action. Cyberlium teaches mentor-readable TI report format — defender handoff hygiene. Refused: prod paste, marketplace dump reports, offensive recommendations. Lab row: TI report outline seven sections linked to analysis notes stub.
1. Report sections
BLUF, audience, scope, findings, ATT&CK link, limitations, recommendations — seven anchors.
Findings cite Module 5 mapping rows where applicable — honest coverage gaps.
Command guide
Try these commands — Report sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA advisory format — https://www.cisa.gov/topics/cyber-threats-and-advisories MITRE ATT&CK — https://attack.mitre.org/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/reports/ti-report-template.md" <<'EOF'
# Threat Intelligence Report — YOUR lab template
## Executive Summary
One paragraph: who cares, what happened (fake scenario), recommended action
## Key Findings
- IOCs: see iocs/iocs.json (example.com / RFC1918 / EICAR label only)
- TTPs: ATT&CK techniques with IDs from attack.mitre.org
## Threat Details
Campaign timeline, infrastructure pattern, detection opportunities
## Recommendations
1. Block/quarantine fake lab domains in test SIEM rule
2. Add Navigator layer techniques to detection backlog
3. Retire IOCs after TTL per feed-quality-checklist.md
## References
- MITRE ATT&CK, CISA advisories, FIRST sharing norms
## TLP
TLP:CLEAR — lab training artifact
EOFCommand — copy this
grep -E 'Executive Summary|ATT&CK|TLP|iocs.json' "$TI_LAB/reports/ti-report-template.md" curl -sS https://www.cisa.gov/topics/cyber-threats-and-advisories | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: CISA advisory format (https://www.cisa.gov/topics/cyber-threats-and-advisories); MITRE ATT&CK (https://attack.mitre.org/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Audience discipline
SOC copy includes IOC/TTP detail stub; exec copy leads BLUF — document both outlines.
Limitations paragraph mandatory — lab vs prod scope labeled.
3. Refused
No prod case paste; no marketplace dump; no offensive action recommendations.
Report literacy supports decision support — not unauthorized operations.
4. What you ship: TI report outline
Seven sections linked to analysis notes + limitations + NEVER prod paste line.
5. What you record before the next lesson
TI report outline path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Email employer exec TI report with live breach victim details pasted from news as 'lab report.'
Right
TI report outline from `$TI_LAB` analysis stub. Next: Actionable Intel.
Mission: TI report outline
1) List seven report sections. 2) Link each to analysis notes stub. 3) Audience tailoring stub UTC. 4) Write NEVER prod paste line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “BLUF — literacy vs hype?”
Knowledge Check
APPLY: TI reports use:
Multiple choice
Knowledge Check
APPLY: True or False: Limitations paragraph optional in TI reports.
True or False
Knowledge Check
APPLY: Report sections include:
Multiple choice