Lesson 5.2: Capstone: the weekly threat briefing
Every Monday Northwind's security team turns the past week's advisories and campaign reports into a short briefing: what applies to us, how urgent it is, and who does what by when. This week's feed has three vendor advisories and two campaign reports. In the lab you read the feed, match products against the inventory, compare versions and exploitation status, connect the campaigns to the incidents you handled earlier in this course, write each item with a priority and an action, sort them and seal the briefing.
24 min
You will learn to
- Triage a week of threat intelligence
- Match advisories to the inventory
- Prioritise by exploitation and exposure
- Link campaigns to defensive actions
- Write and seal an actionable briefing
Key terms
- Threat intelligence feed
- A stream of advisories, indicators and campaign reports from vendors, CERTs and sharing groups.
- Triage
- Deciding quickly what applies and how urgent it is.
- Priority (P1–P3)
- A label tied to a deadline, e.g. P1 within 24 hours.
- Not applicable (NA)
- Recorded explicitly, so the question isn't asked again.
- TTP
- Tactics, techniques and procedures: how an attacker operates.
← Getting ready for post-quantum cryptography · All lessons · Encryption in everyday life: at rest, in transit, and hashing →