Free lab · no signup · about 5 minutes
Intel Inbox: The Triage Rush
Threat intelligence is only useful when it reaches the person who can act on it. Indicators go to the blocklist, attacker techniques go to detection engineering, trends go to the CISO, and everything else is noise.
Pick your sector and tech stack, then sort a live feed of more than 30 items against the clock. Duplicates, stale lists and unverified rumours are mixed in, and somewhere in the pile is a government advisory about a product you run, already being exploited.
Monday 08:00 · you are the CTI analyst on shift
Overnight, your feeds filled up. Items keep arriving. Sort each one: tactical, operational, strategic or noise, then send it to the team that acts on it.
How it works
Tactical (the what) goes to the Blocklist, or to Patch now when it is an exploited flaw. Operational (the how) goes to Detection engineering. Strategic (the why) goes in the CISO brief. Noise (duplicates, stale items, unverified rumours, other sectors, products you do not run) is Discarded.
Attention residue rises each time you jump to an item from a different source. Turn on Folders to group the inbox by topic: switching inside a folder costs nothing.
Criticals: an exploited flaw in a product you run must reach Patch now within 60 seconds of arriving, or a breach fires.
Keys: 1–4 pick the level, B / P / D / C / X pick the route, Enter files it, N opens the next item.
Synthetic training data: every feed item, organisation, product, CVE number, domain, IP address (RFC 5737 ranges) and group name is invented.
How the three levels of intelligence work
Think of one ransomware campaign seen from three desks. The tactical view is the list of addresses, domains and file hashes it used last week. It is precise, cheap to act on and quick to go stale: block it at the firewall, proxy and EDR with an expiry date, or, when it is an exploited flaw in your product, patch.
The operational view is how the crew works: VPN login, discovery with built-in tools, credential dumping, then lateral movement. Those behaviours change slowly, so detection rules written against them keep working after the infrastructure moves. This is what detection engineers and hunters need, usually mapped to MITRE ATT&CK techniques.
The strategic view is why your sector is in the crosshairs and what that means for budgets: dwell times shrinking, regulators shortening reporting deadlines, insurers asking for phishing-resistant MFA. No firewall rule comes out of it; a board decision might.
A good triage habit asks three questions in order: is it relevant to us, can we trust it, and who acts on it? Relevance kills most of a feed. Trust separates an agency advisory from a forum boast. Routing makes sure the remaining items do not stall in the analyst’s inbox.
Why folders beat tabs
Working from twenty browser tabs means switching context with every item: a vendor blog, then a news site, then a chat channel. An RSS-based aggregator puts every source in one pane and lets you group them into folders such as Daily CTI checks, Vulnerabilities, Ransomware, Cloud, Actor tracking and Sector threats. The game’s attention residue meter models that cost. Build your own set of folders in step 2 of the track.
Questions
What is the difference between tactical, operational and strategic threat intelligence?
Tactical intelligence is the what: specific indicators such as IP addresses, domains, file hashes and exploited CVEs, used to block and patch. Operational intelligence is the how: the techniques and playbooks an adversary uses, usually mapped to MITRE ATT&CK, used by detection engineers and threat hunters. Strategic intelligence is the why: trends, motives, geopolitics and sector targeting, used by the CISO and the board to decide where to invest.
How do you triage a threat intelligence feed quickly?
Filter for relevance first: does it touch your sector or a product you run? Then check the source and age: a government advisory about an exploited flaw beats a news copy of it, and a two-year-old IP list is noise. Drop duplicates, treat social-media claims as tips until confirmed, and send what is left to the team that acts on it: blocklist, patching, detection engineering or the CISO brief.
What is attention residue in threat intelligence work?
Attention residue is the part of your focus left behind on the last task when you switch to a new one. Jumping between a dozen sources and tabs leaves a little residue each time, so analysts read more and notice less. Grouping feeds into topic folders in one aggregator keeps similar items together and cuts the switching.
Is the data in the game real?
No. Every item, product, CVE number, domain, IP address and group name is synthetic training data. Real agencies and vendors are not quoted. The game teaches the sorting skill, not current indicators.
Keep going
- Feed Architect: build the aggregator that feeds this inbox, then play a two-week season against it.
- Pivot Board: turn one suspicious domain into a campaign, a blocklist, a detection and a CISO brief.
- Threat Intel Feed: real APT and ransomware research, filterable by actor and sector.
- CTO Threat Brief Review: rate the source and the information in three intel briefs.
- Leak-Forum CTI Lab: spot recycled breaches and duplicate claims.
Further reading: Kraven Security, “Stop Drowning in Data: Build Your Own CTI Aggregator for Free”, on building a free RSS aggregator for CTI.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.