Threat › Module 9 › Lesson 2
TI Reports
TI report literacy — BLUF, audience, scope, limitations — structure rows on `$TI_LAB` report stub only.
Visual · t33_ti_reports
TI reports = named report structure rows. $TI_LAB. Original Cyberlium.
Opening
Stakeholders read reports not raw notes — name TI report sections on YOUR lab stub before emailing prod leadership without RoE.
TI report literacy names: BLUF/bottom line category, audience tailoring (SOC vs exec literacy stub), scope and methodology section, findings with ATT&CK link category, limitations and confidence summary category, and recommendations separated from analysis category. Analyst drafts TI report outline on `$TI_LAB` — maps seven sections to Module 9-1 analysis notes stub — without prod case paste without RoE, without report as marketplace IOC dump, without recommendations that imply unauthorized offensive action. Cyberlium teaches mentor-readable TI report format — defender handoff hygiene. Refused: prod paste, marketplace dump reports, offensive recommendations. Lab row: TI report outline seven sections linked to analysis notes stub.
1. Report sections
BLUF, audience, scope, findings, ATT&CK link, limitations, recommendations — seven anchors.
Findings cite Module 5 mapping rows where applicable — honest coverage gaps.
Command guide
Try these commands — Report sections
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: CISA advisory format (https://www.cisa.gov/topics/cyber-threats-and-advisories); MITRE ATT&CK (https://attack.mitre.org/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Audience discipline
SOC copy includes IOC/TTP detail stub; exec copy leads BLUF — document both outlines.
Limitations paragraph mandatory — lab vs prod scope labeled.
3. Refused
No prod case paste; no marketplace dump; no offensive action recommendations.
Report literacy supports decision support — not unauthorized operations.
4. What you ship: TI report outline
Seven sections linked to analysis notes + limitations + NEVER prod paste line.
5. What you record before the next lesson
TI report outline path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Email employer exec TI report with live breach victim details pasted from news as 'lab report.'
Right
TI report outline from `$TI_LAB` analysis stub. Next: Actionable Intel.
Mission: TI report outline
1) List seven report sections. 2) Link each to analysis notes stub. 3) Audience tailoring stub UTC. 4) Write NEVER prod paste line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “BLUF — literacy vs hype?”
Knowledge Check
APPLY: TI reports use:
Multiple choice
Knowledge Check
APPLY: True or False: Limitations paragraph optional in TI reports.
True or False
Knowledge Check
APPLY: Report sections include:
Multiple choice