ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
CTI Source Exploitation and Pivoting Guide
2
3
4
5
The aim of this document is to support CTI analysis by providing analysts with a checklist of information that can be pivoted for a given indicator and act both as a "checklist" of analysis completeness and guide for daily operations. The document is separated into tabs referring to specific indicator types and the data that they should be queried for. The last tab is a sample template where an analyst can record the results of pivots. Given that pivoting is often performed on large data sets, which can be cumbersome to track in a spreadsheet, the aim is more to provide a workflow guidelines for implementation in a specific collection environment.
Additionally included is a template for cataloging properties of related to given indicator to create a composite object, as described by Joe Slowik in blogpost https://www.domaintools.com/resources/blog/analyzing-network-infrastructure-as-composite-objects/
6
7
8
9
10
11
12
13
14
15
16
Table of content
17
IP Addresses
18
Domains
19
Web Service/Protocol Specific Data
20
Pivot Template
21
Pivot Template sample/guide
22
Composite Object Template
23
Composite Object Template Sample
24
25
26
Picture source: https://domaintools.com/wp-content/uploads/analyzing-network-infrastructure-as-composite-objects-image-4.jpg
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100