Threat › Module 2 › Lesson 3
Consumers Named
Consumers named literacy identifies SOC, hunt team, IR, leadership, and engineering as intel audiences — match output format on YOUR $TI_LAB notes.
Visual · t33_consumers_named
Intel consumers literacy. $TI_LAB only. Original Cyberlium.
Opening
Same intel, different packaging — literacy names consumers so you tailor dissemination on lab workflows before production TI platforms.
Intel consumers include: SOC analysts needing tactical IOCs and ATT&CK IDs; threat hunters needing TTP patterns and hypotheses; incident responders needing campaign context and timeline; leadership needing strategic risk summaries; detection engineers needing rule-ready technique mappings; vulnerability management needing CVE priority. Wrong packaging wastes action. Cyberlium maps consumers on YOUR $TI_LAB — one fictional lab IOC packaged three ways for three roles. Next: Fundamentals Lab.
1. Intel consumers (named)
SOC: blocklist entries, enrichment context, ATT&CK technique ID, confidence score. Hunt: TTP hypothesis, related lab IOC cluster, suggested log sources. IR: campaign timeline, actor profile summary, scope of compromise indicators. Leadership: risk trend, business impact, mitigation investment ask.
On $TI_LAB, write one fictional lab IOC formatted for SOC vs leadership in two sentences each.
Command guide
Try these commands — Intel consumers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK for SOC — https://attack.mitre.org/ CISA advisories — https://www.cisa.gov/topics/cyber-threats-and-advisories FIRST sharing — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/notes/intel-consumers-named.txt" <<'EOF'
TI consumers — NAMED LITERACY:
SOC analysts: tactical IOCs → SIEM/EDR rules, hunt queries
IR team: operational context → containment priorities, timeline
Leadership: strategic briefs → budget, risk acceptance, vendor decisions
AppSec/Engineering: ATT&CK gaps → control improvements, detection engineering
Legal/Compliance: breach notification, regulatory reporting context
Lab: map YOUR fake IOC report sections to each consumer — no real victim data
EOFCommand — copy this
grep -E 'SOC analysts|IR team|Leadership|ATT&CK' "$TI_LAB/notes/intel-consumers-named.txt" curl -sS https://www.cisa.gov/topics/cyber-threats-and-advisories | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK for SOC (https://attack.mitre.org/); CISA advisories (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST sharing (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why consumer literacy improves intel value
Raw STIX bundle to executive without summary fails dissemination. Tactical hash list without ATT&CK context frustrates detection engineers. Mature TI teams maintain consumer matrix with format templates.
Students practice consumer packaging on lab notes — production dissemination follows org classification and handling rules.
3. Lab boundary
Forbidden: sharing lab IOCs outside $TI_LAB without labeling training-only. Allowed: consumers card — four roles with format example for $TI_LAB fictional IOC.
Ship: intel consumers card for YOUR lab notes. Next: Fundamentals Lab.
4. What you ship: intel consumers card for $TI_LAB
Four consumer roles with format examples. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Consumers card. $TI_LAB named. File t33-m02-l03-consumers-named.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Email raw IOC dump to CEO. Skip consumer labels on lab dissemination notes.
Right
Write intel consumers card for YOUR $TI_LAB. Next: Fundamentals Lab.
Mission: package intel for named consumers
1) List four consumer roles. 2) Format one fictional lab IOC for SOC and leadership. 3) Note one handling rule per role. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
SOC wants technique ID and confidence — leadership wants business impact in plain language.
Knowledge Check
APPLY: SOC analysts primarily consume:
Multiple choice
Knowledge Check
APPLY: True or False: Same intel should be packaged differently for SOC vs leadership.
True or False
Knowledge Check
APPLY: Consumers named literacy on Cyberlium uses:
Multiple choice