Free lab · no signup · about 10 minutes
Pivot Board: From IOC to Board Brief
One indicator is a starting point, not an answer. Pivot from it to the campaign, the technique and the motive, and you can block it, detect the next one and tell leadership what it means.
A finance workstation is beaconing to an unfamiliar domain. Eight reports sit in one pane: a sandbox write-up, vendor research, a government advisory, passive DNS, a forum post, a news story and an ISAC report. Click any entity to see every report that mentions it, pin the campaign to the board, and watch out for the shared hosting IP and the lookalike group name.
Synthetic training data: every report, organisation, actor alias, domain, IP address (RFC 5737) and hash is invented and regenerated each case. ATT&CK technique IDs are real.
How the three levels of intelligence work
This case climbs all three levels in one sitting. The tactical layer is the indicators: the domain, two command-and-control addresses and two file hashes. They go to the blocklist with an expiry, because addresses are reassigned and domains are dropped.
The operational layer is the chain of behaviour: a link to a disk image, a shortcut that skips the download warning, rundll32 running a DLL, an HTTPS beacon, credential dumping and RDP. Mapped to MITRE ATT&CK, those become detection rules that outlive the indicators.
The strategic layer is who and why: an access broker who sells footholds to ransomware crews, and a sector where that resale has turned into encryption within three weeks. That is what the board needs, framed as risk, trend and a specific ask.
Red herrings are part of the job. A shared hosting address links your domain to hundreds of innocent sites. A group with almost the same name does something completely different. Linking only what a report actually connects keeps them off the board.
Questions
What does pivoting mean in threat intelligence?
Pivoting is using one known fact to find related ones. Starting from a domain in your proxy logs, you look it up in reports and passive DNS, find the IP addresses and file hashes it is connected to, then the techniques and the group those indicators belong to. Each hop adds context until you can say who is behind the activity, how they work and what they want.
How long should indicators stay on a blocklist?
It depends on the type. Attacker IP addresses get reassigned quickly, so a short expiry such as 30 days with a review is common. Domains last longer but get dropped or sinkholed, so around 90 days. File hashes never change meaning and rarely cause false positives, so they can stay much longer. Never block a shared hosting IP that serves many unrelated sites.
What should a CISO threat brief contain?
Three things in plain language: the risk to the business (what happened, who is behind it and why it matters), the trend that puts it in context (for example, the same lure hitting sector peers), and a specific recommendation with a cost or time frame. Indicator lists and technique IDs belong in the SOC and detection backlogs, not in the board pack.
Are the reports and indicators real?
No. Every report, company, actor alias, domain (.example and .test), IP address (RFC 5737 documentation ranges) and hash is synthetic training data, regenerated for each case. The MITRE ATT&CK technique IDs are real and used as ATT&CK defines them.
Keep going
- Intel Inbox: triage a timed feed into tactical, operational, strategic or noise.
- Feed Architect: choose the sources that would have surfaced these reports in time.
- APT Naming Rosetta Stone: one actor, many vendor names.
- Detection Lab: write and tune the behavioural rule you picked here.
- CTO Threat Brief Review: grade three intel briefs as the reader.
Further reading: Kraven Security, “Stop Drowning in Data: Build Your Own CTI Aggregator for Free”, on building a free RSS aggregator so sources like these land in one pane.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.