Threat › Module 2 › Lesson 1
TI Types
TI types literacy names strategic, operational, and tactical intel — read report tiers on YOUR $TI_LAB notes before live feed integration.
Visual · t33_ti_types
TI types literacy. $TI_LAB only. Original Cyberlium.
Opening
Not all intel serves the same audience — literacy teaches strategic, operational, and tactical tiers on lab notes you own.
Strategic intel informs leadership on long-term risk — actor motivation, geopolitical trends, industry targeting. Operational intel tracks campaigns and infrastructure over weeks. Tactical intel delivers IOCs and TTPs for immediate detection — hashes, domains, ATT&CK technique IDs. Technical intel covers vulnerabilities and malware families. Literacy names the tiers before you consume feeds. Cyberlium maps TI types on YOUR $TI_LAB — document fictional examples of each tier on paper. Next: Intel Lifecycle.
1. Intel tiers (named)
Strategic: why actors target your sector — board-level briefings. Operational: which campaigns are active — hunt team focus. Tactical: specific IOCs and TTPs — SOC enrichment and blocklists. Technical: CVE details and malware family traits — patch and signature teams.
On $TI_LAB, write one fictional example sentence for each tier using lab-only actor names.
Command guide
Try these commands — Intel tiers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA TI overview — https://www.cisa.gov/topics/cyber-threats-and-advisories MITRE ATT&CK — https://attack.mitre.org/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
python3 - <<'PY'
types = ['Strategic: long-term trends for executives (APT landscape, sector risk)', 'Operational: campaign context for IR/planners (actor TTPs, timing)', 'Tactical: IOCs + immediate detections for SOC (IPs, hashes, domains)', 'Technical: malware analysis artifacts feeding tactical layer']
print('TI types literacy (defensive consumption):')
for i, t in enumerate(types, 1): print(f' {i}. {t}')
PYCommand — copy this
curl -sS https://attack.mitre.org/ | head -8
Primary tools to practice this lesson: python3, curl. Reference sites: CISA TI overview (https://www.cisa.gov/topics/cyber-threats-and-advisories); MITRE ATT&CK (https://attack.mitre.org/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why tier literacy prevents mis-routed intel
Feeding strategic geopolitical analysis to tier-1 SOC without translation wastes analyst time. Tactical IOCs without operational campaign context miss prioritization. Defenders match intel type to consumer role.
Students label tier on lab report excerpts — never import live victim campaign data without authorization.
3. Lab boundary
Forbidden: claiming tactical IOC dumps are strategic briefings without context. Allowed: TI types card — four tiers with $TI_LAB fictional examples.
Ship: TI types card for YOUR lab notes. Next: Intel Lifecycle.
4. What you ship: TI types card for $TI_LAB
Four tiers with fictional lab examples. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. TI types card. $TI_LAB named. File t33-m02-l01-ti-types.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Send raw IOC list to executive as strategic brief. Skip tier labels on lab notes.
Right
Write TI types card for YOUR $TI_LAB. Next: Intel Lifecycle.
Mission: map TI tiers on YOUR lab
1) Define strategic, operational, tactical, technical in one sentence each. 2) Write one fictional example per tier. 3) Name which consumer role uses each tier. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tactical IOCs feed SIEM — strategic intel feeds risk committees. Label before you share.
Knowledge Check
APPLY: Tactical intel primarily delivers:
Multiple choice
Knowledge Check
APPLY: True or False: Strategic intel informs long-term risk decisions at leadership level.
True or False
Knowledge Check
APPLY: TI types literacy on Cyberlium uses:
Multiple choice