eHs

SCORP² THREAT INTELLIGENCE ARCHITECT

Advancing Space Collective Defense Through Community-Driven Intelligence Sharing

METEORSTORM & Space Collective Defense

4 Hours | 4 Knowledge Domains | 4 CPE Credits

NIST NICE PD-WRL-006: Threat Analysis

Delivered by ProofLabs | In partnership with ethicallyHackingspace (eHs)®

SCORP² Threat Intelligence Architect

MISSION BRIEFING

Your Four-Mission Journey to Becoming a Threat Intelligence Architect

Today you become intelligence architects. Each mission builds on the last—from understanding doctrine, to building platforms, to connecting the constellation, to launching live systems. By the end, you will have deployed and integrated enterprise threat intelligence platforms ready for Space Collective Defense.

MISSION 1: ORACLE — Learn to See | Threat-Informed Defense & Intelligence Planning
MISSION 2: FORGE — Build the Engine | TIP Architecture & Engineering
MISSION 3: NEXUS — Connect the Constellation | Machine-to-Machine Sharing & Space Collective Defense
MISSION 4: IGNITION — Launch the Platform | Hands-On Lab: Platform Deployment

MISSION QUESTION

If you could design the perfect threat intelligence sharing system for the space domain from scratch, what would be its single most important capability?

SCORP² Threat Intelligence Architect

SPACE COLLECTIVE DEFENSE

No Single Entity Can Secure Space Alone

Space Collective Defense is the collaborative strategy where space operators, critical infrastructure owners, government agencies, and commercial partners share threat intelligence and coordinate defensive actions in real time.

A cyber threat to one operator is a concern for all
Shared situational awareness is a force multiplier
Intelligence sharing transforms isolated defense into sector-wide protection
Real-time coordination enables collective disruption of adversary operations
The space domain requires a unique, unified defensive posture

SCORP² Threat Intelligence Architect | NIST NICE PD-WRL-006

SCORP² Threat Intelligence Architect

THE THREAT INTELLIGENCE ARCHITECT

Core Competencies & NIST NICE Alignment

The Threat Intelligence Architect designs, deploys, and operates the intelligence infrastructure that enables Space Collective Defense.

Intelligence Planning Doctrine — PIR, EEI, Indicators, SIR from CJCSM 3314.01A
TIP Architecture — OpenCTI and MISP platform design and engineering
STIX/TAXII Implementation — Machine-to-machine sharing protocols
Sharing Governance — Trust frameworks, legal considerations, policy
Platform Engineering — Deployment, configuration, and integration

NIST NICE Work Role PD-WRL-006: Threat Analysis

This course takes you from doctrine to deployment in four hours.

SCORP² Threat Intelligence Architect

COURSE LEARNING OUTCOMES

Four Missions. Four Outcomes. One Architecture.

1. ORACLE — Apply adapted joint intelligence planning methodology (PIR, EEI, Indicators, SIR) from CJCSM 3314.01A to commercial space and critical infrastructure contexts
2. FORGE — Evaluate and architect enterprise threat intelligence platforms using OpenCTI and MISP, including deployment, configuration, and integration
3. NEXUS — Implement STIX 2.1 and TAXII 2.1 for machine-to-machine intelligence sharing with ISACs and partner organizations
4. IGNITION — Deploy functional OpenCTI and MISP instances with automated ingestion, correlation, and bidirectional synchronization

SCORP² Threat Intelligence Architect

👁 MISSION 1 ORACLE

MISSION 1: ORACLE

Threat-Informed Defense & Intelligence Planning — Learn to See

Before you can build intelligence systems, you must understand the doctrine that drives them. This mission traces threat intelligence from its military origins through today's commercial landscape to the autonomous future—and equips you with the intelligence planning methodology that will guide every decision you make as an architect.

Domain: Threat-Informed Defense & Intelligence Planning
Duration: 60 Minutes
Reference: CJCSM 3314.01A | Intelligence Planning
Codename: ORACLE — "Learn to See"

SCORP² Threat Intelligence Architect

MISSION 1 OBJECTIVES

What You Will Master in ORACLE

1. Trace the evolution of threat intelligence from military doctrine through commercial CTI to autonomous M2M sharing
2. Describe the intelligence cycle: direction, collection, processing, analysis, dissemination, feedback
3. Explain key milestones: Cyber Kill Chain, Diamond Model, MITRE ATT&CK, and their relevance to space
4. Assess organizational threat intelligence maturity using the five-level model
5. Adapt CJCSM 3314.01A intelligence planning methodology for commercial space cybersecurity
6. Develop Priority Intelligence Requirements (PIR) decomposed into EEI, Indicators, and SIR
7. Complete intelligence planning templates: PIR Worksheet, EEI Decomposition, Indicator Mapping, SIR/Collection Matrix

SCORP² Threat Intelligence Architect

HISTORICAL FOUNDATIONS

From Military Doctrine to Cyber Intelligence

The evolution of threat intelligence spans decades of paradigm shifts, from signature-based detection to adversary-centric analysis.

Military Intelligence Doctrine — The intelligence cycle as the foundational framework
Signature-Based Defense Era — Pattern matching, IOC lists, reactive posture
Lockheed Martin Cyber Kill Chain (2011) — Adversary lifecycle modeling
Diamond Model of Intrusion Analysis (2013) — Adversary, capability, infrastructure, victim
MITRE ATT&CK (2013–present) — Adversary tactics, techniques, and procedures at scale
Threat-Informed Defense — Shift from "what signatures do we have?" to "what does the adversary intend?"

"CJCSM 3314.01A and the Adaptive Planning and Execution (APEX) system represent the doctrinal foundation we adapt for commercial application."

MISSION QUESTION

The intelligence cycle was designed for nation-state military operations. What changes when you adapt it for a commercial satellite operator with a 12-person security team?

SCORP² Threat Intelligence Architect

CURRENT STATE OF THREAT-INFORMED DEFENSE

The Five-Level Maturity Model

The threat intelligence landscape has matured into a rich ecosystem of frameworks, standards, platforms, and sharing communities.

Level 1 — Ad-hoc — Reactive, no formal program, IOC-only
Level 2 — Repeatable — Basic processes, some tooling, limited sharing
Level 3 — Defined — Formal program, TIP deployed, ISAC participation
Level 4 — Managed — Metrics-driven, automated sharing, PIR-aligned production
Level 5 — Optimizing — Autonomous M2M sharing, AI-augmented analysis, collective defense

Standards: STIX 2.1, TAXII 2.1, OpenIOC, YARA, Sigma | Platforms: OpenCTI, MISP, Recorded Future, Mandiant

MISSION QUESTION

Where would you place your organization on this maturity model? What is the single biggest barrier to reaching the next level?

SCORP² Threat Intelligence Architect

THE FUTURE: AUTONOMOUS COLLECTIVE DEFENSE

Six Pillars of the Intelligence Architecture of Tomorrow

The threat intelligence landscape is evolving toward autonomous, machine-speed collective defense at sector scale.

Space Collective Defense as the organizing principle for the entire sector
Autonomous M2M sharing at machine speed — no human in the loop for indicator distribution
AI/ML-augmented analysis — automated indicator generation and threat actor profiling
Space-domain requirements — LEO, MEO, GEO, and cislunar threat intelligence matrices
IT/OT/Space convergence — unified threat intelligence across all system types
Regulatory evolution — SEC cyber disclosure, EU NIS2, space-specific cybersecurity requirements

"The TIA you become today builds the infrastructure that enables this future."

MISSION QUESTION

If machines can share threat intelligence at machine speed, what role remains for human intelligence analysts? How do we avoid automation bias?

SCORP² Threat Intelligence Architect

INTELLIGENCE PLANNING DOCTRINE

Adapting CJCSM 3314.01A for Commercial Cybersecurity

CJCSM 3314.01A provides the doctrinal framework for intelligence planning that we adapt for commercial space cybersecurity operations.

APEX System — Adaptive Planning and Execution: deliberate and crisis action planning
Two Lines of Effort — Intelligence Support to Planning + Planning Intelligence Operations
J-2 → CISO/CTI Lead — The intelligence function translated to commercial roles
CCMD → SOC Director — Command authority mapped to security operations leadership
CSA → CTI Lead/ISAC Coordinator — Intelligence sharing coordination role
Intelligence Planning → Threat Intelligence Program Management

"Military doctrine provides the rigor and structure. Commercial application provides the agility and scale. The TIA bridges both."

SCORP² Threat Intelligence Architect

DECISION-CENTRIC INTELLIGENCE

PIR: The Intelligence Questions That Drive Everything

Intelligence exists to support decisions. Every PIR must be anchored to a specific decision context at the executive, security, mission, or regulatory level.

Data → Information → Intelligence — The transformation pipeline
Tactical — Asset-level intelligence for SOC operations
Operational — Segment-level intelligence for security program management
Strategic — Mission-level intelligence for executive decision-making
PIR Decomposition Chain — PIR → EEI → Indicators → SIR
Production Requirements Matrix (PRMx) and Collection Requirements Matrix (CRMx)

"A PIR without a decision context is just a question. Tied to a decision, it becomes the engine of your intelligence program."

MISSION QUESTION

Your CEO asks: 'Are we safe?' How do you translate that into actionable Priority Intelligence Requirements that your team can actually answer?

SCORP² Threat Intelligence Architect

PIR DECOMPOSITION: A WORKED EXAMPLE

From Strategic Question to Collection Requirement

Strategic PIR: "Are nation-state actors actively targeting commercial LEO communication constellations?"

EEI — System Dimension: Which constellation subsystems are being probed?
EEI — Adversary Dimension: Which APT groups have demonstrated space-targeting capability?
EEI — Environment Dimension: What geopolitical conditions increase targeting likelihood?
Indicators (Leading): Reconnaissance scanning of ground station IP ranges; SPARTA technique SA-0001 activity
Indicators (Lagging): Compromised credentials on dark web for satellite operators
SIR: Source assignment with LTIOV (Latest Time Information of Value) and handling caveats

SCORP² Threat Intelligence Architect

MISSION 1 EXERCISE

Complete Your Intelligence Planning Documents

Using the provided scenario, complete the four intelligence planning templates.

Template 1 — PIR Development Worksheet: Decision-linked PIRs with time horizons and confidence thresholds
Template 2 — EEI Decomposition Template: System, adversary, and environment dimensions
Template 3 — Indicator Mapping Table: Leading and lagging indicators with source reliability ratings
Template 4 — SIR and Collection Mapping Matrix: Source assignment with LTIOV and handling caveats

Timer: 5 minutes | Guided walkthrough with instructor

Deliverable: Completed set of four intelligence planning documents ready for platform integration in Mission 2.

SCORP² Threat Intelligence Architect

MISSION 1 CHECKPOINT

Test Your Understanding

Q1: Describe the evolution from signature-based defense to threat-informed defense. What was the key paradigm shift, and how does CJCSM 3314.01A doctrine inform modern commercial intelligence programs?

Q2: Walk through the PIR decomposition chain (PIR → EEI → Indicators → SIR). Why is each level necessary, and what happens if you skip a level?

Capstone Activity: Present your PIR decomposition to your team. Defend your indicator selection and source assignments.

MISSION QUESTION

Intelligence planning gives you structure, but the threat landscape changes daily. How do you build an intelligence program that is both rigorous and adaptive?

SCORP² Threat Intelligence Architect

MISSION 1 ASSESSMENT

Three Criteria | Four Proficiency Levels

Criterion 1 — Doctrinal Understanding: Accurately describes the evolution of threat-informed defense and the intelligence cycle, with correct adaptation of CJCSM 3314.01A concepts
Criterion 2 — PIR Development: Develops well-formed, decision-linked PIRs with complete decomposition through EEI, Indicators, and SIR
Criterion 3 — Template Completion: All four planning templates completed with appropriate detail, source assignments, and handling caveats

Proficiency Levels: Emerging | Developing | Proficient | Expert

SCORP² Threat Intelligence Architect

👁 MISSION 1 ORACLE

MISSION 1: ORACLE — COMPLETE

You now have the doctrinal foundation and intelligence planning methodology. But methodology without infrastructure is just paperwork.

ORACLE — Complete ✔
Intelligence cycle mastered
PIR decomposition chain applied
Four planning templates completed

Next mission: FORGE — we build the platforms that bring your intelligence architecture to life.

SCORP² Threat Intelligence Architect

10:00

10-MINUTE BREAK

Mission 2: FORGE Begins in 10 Minutes

Take a break. When you return, we build the engine.

Next: Threat Intelligence Platform Architecture & Engineering
OpenCTI — Knowledge management for cyber threat intelligence
MISP — Community-driven threat intelligence sharing
Deep dives into architecture, data models, and connector ecosystems

SCORP² Threat Intelligence Architect

⚒ MISSION 2 FORGE

MISSION 2: FORGE

TIP Architecture & Engineering — Build the Engine

Your intelligence planning is complete. Now build the platforms that will power it. This mission takes you deep into the architecture, data models, and connector ecosystems of OpenCTI and MISP—the twin engines of your threat intelligence infrastructure.

Domain: TIP Architecture & Engineering
Duration: 60 Minutes
Platforms: OpenCTI | MISP
Codename: FORGE — "Build the Engine"

SCORP² Threat Intelligence Architect

MISSION 2 OBJECTIVES

What You Will Master in FORGE

1. Define TIP functional requirements: ingest, correlate, analyze, produce, share
2. Compare architecture patterns: centralized, distributed, federated, and hybrid
3. Architect OpenCTI deployments: GraphQL API, Elasticsearch, Redis, RabbitMQ, S3/MinIO, connectors
4. Architect MISP deployments: MySQL/MariaDB, REST API, galaxies, taxonomies, warninglists
5. Design OpenCTI-MISP bidirectional synchronization with STIX 2.1 and TAXII 2.1
6. Plan SIEM/SOAR integration for operational intelligence delivery

SCORP² Threat Intelligence Architect

THREAT INTELLIGENCE PLATFORM STRATEGY

Five Core Functions of a TIP

Every threat intelligence platform must fulfill five core functions to deliver operational value.

Ingest — Collection from feeds, APIs, manual entry, and automated sources
Correlate — Cross-reference indicators, enrich context, identify relationships
Analyze — Investigation workbenches, relationship mapping, threat actor profiling
Produce — Reports, dashboards, briefings for all stakeholder levels
Share — STIX/TAXII export, ISAC distribution, partner sharing

Architecture Patterns: Centralized | Distributed | Federated | Hybrid

MISSION QUESTION

Your organization operates ground stations in three countries with different data sovereignty laws. Which architecture pattern best balances intelligence sharing with regulatory compliance?

SCORP² Threat Intelligence Architect

OpenCTI: KNOWLEDGE MANAGEMENT FOR CTI

The STIX 2.1 Native Intelligence Platform

OpenCTI is designed as a knowledge management system for cyber threat intelligence, with STIX 2.1 as its native data model.

Component Stack: GraphQL API → Elasticsearch/OpenSearch → Redis → RabbitMQ → S3/MinIO
Data Model: Entities (threat actors, campaigns, malware, vulnerabilities), relationships, observables
Connector Ecosystem: MITRE ATT&CK, CVE, AlienVault OTX, AbuseIPDB, and 200+ connectors
Analytical Workbenches: Investigation, correlation, and assessment tools
Dashboard & Reporting: Custom dashboards, automated reports, decision-maker views
Deployment: Docker Compose stack — all services orchestrated in a single configuration

SCORP² Threat Intelligence Architect

MISP: COMMUNITY-DRIVEN THREAT INTELLIGENCE SHARING

The Open-Source Platform Built for Sharing

MISP is optimized for sharing threat intelligence between organizations, with a rich community ecosystem and flexible distribution model.

Data Model: Events, attributes, objects, galaxies, taxonomies, and sightings
Sharing Model: Sharing groups, distribution levels (org only → all communities)
Feed Management: Default feeds, custom feeds, TAXII feeds, freetext import
Correlation Engine: Automatic correlation, warninglists, false positive management
METEORSTORM Integration: github.com/MISP/misp-taxonomies/meteorstorm natively available
Deployment: Docker Compose stack (MySQL/MariaDB, Apache, Redis)

MISSION QUESTION

MISP was designed for community sharing. OpenCTI was designed for knowledge management. Why do you need both? What happens if you only deploy one?

SCORP² Threat Intelligence Architect

INTEGRATION & INTEROPERABILITY

Making the Platforms Work Together

The power of the TIA architecture comes from seamless integration between OpenCTI, MISP, and the broader security ecosystem.

OpenCTI → MISP: Export STIX 2.1 bundles for community sharing and distribution
MISP → OpenCTI: Import community intelligence for enrichment and analysis
Bidirectional Sync: Real-time synchronization via the OpenCTI-MISP connector
SIEM Integration: STIX 2.1 export to Elastic SIEM, Splunk, Microsoft Sentinel
SOAR Integration: Automated playbook triggers from intelligence indicators
TAXII 2.1 Feeds: Consume ISAC feeds and publish organizational intelligence

SCORP² Threat Intelligence Architect

STIX 2.1 & TAXII 2.1

The Language and Transport of Machine-to-Machine Intelligence

STIX and TAXII are the foundational standards that enable automated, machine-to-machine threat intelligence sharing.

STIX 2.1 SDOs: Threat Actor, Campaign, Malware, Attack Pattern, Indicator, Vulnerability, Course of Action
STIX 2.1 SROs: Uses, Targets, Attributed-To, Indicates, Mitigates — the relationship fabric
TAXII 2.1 Architecture: Server/client model with API roots, collections, and channels
Authentication Models: API key, OAuth 2.0, certificate-based authentication
ISAC Connectivity: Configure TAXII clients to consume Space ISAC feeds automatically
TLP Enforcement: Traffic Light Protocol encoded in STIX marking definitions

"STIX is what you say. TAXII is how you say it. Together they enable machine-to-machine collective defense."

SCORP² Threat Intelligence Architect

STARCOM-LEO: REFERENCE TIP ARCHITECTURE

A Complete Architecture for a LEO Constellation Operator

The STARCOM-LEO reference architecture demonstrates a complete, operational TIP deployment for a fictional LEO constellation operator.

OpenCTI Instance: MITRE ATT&CK, SPARTA, and CVE connectors; PIR-aligned dashboard
MISP Instance: METEORSTORM taxonomy enabled; Space ISAC sharing group configured
Integration Layer: Bidirectional OpenCTI-MISP sync; TAXII 2.1 feed from Space ISAC
SIEM Integration: STIX 2.1 bundle export to Elastic SIEM for operational alerting
Operational Output: SOC alerts, PIR-aligned leadership dashboards, automated partner sharing
Architecture Pattern: Federated with hybrid elements for data sovereignty compliance

SCORP² Threat Intelligence Architect

MISSION 2 EXERCISE

Design Your TIP Architecture

Working in teams, design a TIP architecture for a provided space operator scenario.

1. Platform selection rationale (OpenCTI, MISP, or both)
2. Architecture pattern choice with justification
3. Connector/feed plan aligned to PIR from Mission 1
4. Integration plan with existing security tools
5. Sharing model and TLP handling

Timer: 10 minutes | Discussion-based, instructor-facilitated

Deliverable: Architecture diagram on whiteboard or digital canvas ready for peer review.

SCORP² Threat Intelligence Architect

MISSION 2 CHECKPOINT

Test Your Understanding

Q1: Compare the data models of OpenCTI and MISP. How does OpenCTI's STIX 2.1 native model differ from MISP's event-attribute model? What are the implications for data fidelity during synchronization?

Q2: You need to share indicators with three different partner organizations at three different TLP levels. How do you configure your architecture to enforce this automatically?

Capstone Activity: Present your TIP architecture design to the class. Defend your platform selection, architecture pattern, and integration decisions.

MISSION QUESTION

Your MISP instance has 50,000 indicators. Your OpenCTI instance correlates them into 200 threat actor profiles. Which platform tells the better story to your CISO—and which one does your SOC need at 3 AM?

SCORP² Threat Intelligence Architect

MISSION 2 ASSESSMENT

Three Criteria | Four Proficiency Levels

Criterion 1 — Platform Knowledge: Demonstrates accurate understanding of OpenCTI and MISP architectures, data models, and capabilities
Criterion 2 — Architecture Design: Produces a viable TIP architecture with appropriate pattern selection, justified component choices, and clear data flows
Criterion 3 — Integration Planning: Plans realistic integration with STIX/TAXII, SIEM/SOAR, and sharing communities with proper TLP enforcement

Proficiency Levels: Emerging | Developing | Proficient | Expert

SCORP² Threat Intelligence Architect

⚒ MISSION 2 FORGE

MISSION 2: FORGE — COMPLETE

Your platforms are designed. But a platform without connections is just a database.

ORACLE — Complete ✔
FORGE — Complete ✔
OpenCTI architecture mastered
MISP architecture mastered
Integration design complete

Next mission: NEXUS — we connect your intelligence architecture to the Space Collective Defense ecosystem.

SCORP² Threat Intelligence Architect

10:00

10-MINUTE BREAK

Mission 3: NEXUS Begins in 10 Minutes

Take a break. When you return, we connect the constellation.

Next: Machine-to-Machine Sharing & Space Collective Defense
ISACs, ISAOs, Government Programs, International Partners
Automated TAXII 2.1 feed configuration
Sharing governance and trust frameworks

SCORP² Threat Intelligence Architect

🔗 MISSION 3 NEXUS

MISSION 3: NEXUS

Machine-to-Machine Sharing & Space Collective Defense — Connect the Constellation

Your platforms are built. Now connect them to the world. This mission integrates your intelligence architecture into the Space Collective Defense ecosystem—ISACs, government programs, international partners, and automated sharing protocols.

Domain: Machine-to-Machine Sharing & Space Collective Defense
Duration: 60 Minutes
Ecosystem: Space ISAC | CISA AIS | JCDC | FIRST | NATO MISP
Codename: NEXUS — "Connect the Constellation"

SCORP² Threat Intelligence Architect

MISSION 3 OBJECTIVES

What You Will Master in NEXUS

1. Define Space Collective Defense and articulate its value proposition for the space sector
2. Map the sharing ecosystem: ISACs, ISAOs, government programs (CISA AIS, JCDC, InfraGard), and international partners (FIRST, NATO MISP)
3. Configure automated TAXII 2.1 feed consumption and publication
4. Implement TLP enforcement for automated distribution control at machine speed
5. Develop sharing governance documents: Trust frameworks, legal considerations, and CISO/CIO/DPO agreements
6. Create organizational threat intelligence policy, standards, and SOPs
7. Measure sharing effectiveness and community value

SCORP² Threat Intelligence Architect

THE SPACE COLLECTIVE DEFENSE ECOSYSTEM

Three Tiers of Intelligence Sharing

The Space Collective Defense ecosystem spans three tiers of sharing partners, each providing unique intelligence value.

Tier 1 — ISACs & ISAOs: Space ISAC, IT-ISAC, Communications ISAC, EI-ISAC — sector-specific intelligence products
Tier 2 — Government Programs: CISA AIS (Automated Indicator Sharing), JCDC (Joint Cyber Defense Collaborative), FBI InfraGard, CNMF advisories
Tier 3 — International Partners: FIRST, TF-CSIRT, NATO MISP instances, Multinational Force Olympic Defender

"Every connection multiplies your visibility. A single operator sees their own threats. A connected community sees the entire threat landscape."

MISSION QUESTION

The Space ISAC shares an indicator that matches activity in your network. But the indicator is TLP:AMBER. You need to share it with a partner who is not an ISAC member. What do you do?

SCORP² Threat Intelligence Architect

MACHINE-TO-MACHINE SHARING

Intelligence at Machine Speed

Human-only workflows cannot scale to the volume and velocity of modern threats. Automated sharing is not optional — it is the only viable path to collective defense.

Real-time TAXII feed consumption from ISACs and partners — no human in the loop
Automated indicator publication to sharing communities with TLP enforcement
TLP-enforced distribution control at machine speed — policy encoded in STIX
Collective disruption operations through shared telemetry and coordinated response
Data flow: ISAC TAXII Server → Your MISP/OpenCTI → Your SIEM → Alert → Response → Intelligence Production → Share Back

MISSION QUESTION

If your automated sharing pipeline publishes a false positive indicator to the ISAC community, what is the blast radius? How do you build safeguards against automated errors?

SCORP² Threat Intelligence Architect

SHARING GOVERNANCE & TRUST

The Framework That Makes Collective Defense Possible

Trust is the foundation of collective defense. Governance documents encode that trust into enforceable agreements.

TLP Framework: TLP:RED | TLP:AMBER+STRICT | TLP:AMBER | TLP:GREEN | TLP:CLEAR — automated enforcement in MISP and OpenCTI
Legal Landscape: CISA Act protections for sharing, antitrust safe harbors, liability limitations, GDPR/CCPA compliance
Sharing Agreements: CISO/CIO/DPO agreement structure — parties, purpose, scope, TLP designation, data protection, liability, termination
Metrics: Indicators shared, time-to-share, community response rate, intelligence value score

MISSION QUESTION

Trust takes years to build and seconds to destroy. How do you design a sharing governance framework that encourages participation while protecting against a single member's breach?

SCORP² Threat Intelligence Architect

TEMPLATE: THREAT INTELLIGENCE POLICY

The Charter for Your Intelligence Program

A policy without a platform is aspirational. A platform without a policy is dangerous. The TIA builds both.

Policy Scope, Authority & Applicability — Who this policy covers and what it governs
Intelligence Program Charter — Mission statement and strategic objectives
Roles & Responsibilities — CTI Lead, Analysts, Stakeholders, Executive Sponsors
Intelligence Requirements Management — PIR lifecycle from Mission 1
Collection, Analysis, Production & Dissemination Procedures — Operational workflows

"A policy without a platform is aspirational. A platform without a policy is dangerous. The TIA builds both."

SCORP² Threat Intelligence Architect

TEMPLATES: STANDARDS, SOPs & SHARING AGREEMENTS

Three Documents That Operationalize Your Program

Threat Intelligence Standards: STIX 2.1 usage standards (required fields, naming conventions), indicator lifecycle management, confidence scoring framework (Admiralty/NATO adaptation)
Threat Intelligence SOP: Daily intelligence operations, indicator triage and prioritization, production workflows (request → research → analysis → review → dissemination), incident-triggered intelligence surge procedures
CISO/CIO/DPO Sharing Agreement: Parties and purpose, TLP enforcement requirements, data protection and privacy obligations, liability limitations and termination provisions

SCORP² Threat Intelligence Architect

MISSION 3 EXERCISE

Customize Your Governance Documents

Using the four provided templates, customize for your organization's context.

Template 1 — Threat Intelligence Policy: Adapt scope, roles, and procedures to your organization
Template 2 — Threat Intelligence Standards: Configure STIX 2.1 usage standards and confidence scoring
Template 3 — Threat Intelligence SOP: Define daily operations and surge procedures
Template 4 — CISO/CIO/DPO Sharing Agreement: Draft sharing terms with a partner organization

Timer: 20 minutes | Guided walkthrough with instructor

Deliverable: Four customized governance documents ready for organizational review.

SCORP² Threat Intelligence Architect

MISSION 3 CHECKPOINT

Test Your Understanding

Q1: Explain the difference between automated feed consumption and automated feed publication. What safeguards must be in place for each?

Q2: A partner organization wants to join your sharing community but operates under GDPR restrictions that limit data transfer. How do you structure the sharing agreement to enable participation while maintaining compliance?

Capstone Activity: Present your customized sharing agreement to the class. Explain your TLP enforcement strategy and how it balances openness with protection.

MISSION QUESTION

Collective defense requires trust, but trust requires verification. In a machine-to-machine sharing ecosystem, how do you verify that a partner's automated systems are behaving as agreed?

SCORP² Threat Intelligence Architect

MISSION 3 ASSESSMENT

Three Criteria | Four Proficiency Levels

Criterion 1 — Ecosystem Knowledge: Accurately maps the Space Collective Defense sharing ecosystem including ISACs, government programs, and international partners
Criterion 2 — Sharing Architecture: Designs viable automated sharing configurations with proper TAXII 2.1 setup and TLP enforcement
Criterion 3 — Governance Documentation: Produces complete, customized policy, standards, SOP, and sharing agreement documents

Proficiency Levels: Emerging | Developing | Proficient | Expert

SCORP² Threat Intelligence Architect

🔗 MISSION 3 NEXUS

MISSION 3: NEXUS — COMPLETE

Your architecture is designed, your governance is in place, and your sharing connections are mapped. There is only one thing left: launch.

ORACLE — Complete ✔
FORGE — Complete ✔
NEXUS — Complete ✔
Sharing ecosystem mapped
Governance documents complete

Next mission: IGNITION — deploy your platforms and prove the architecture works.

SCORP² Threat Intelligence Architect

10:00

10-MINUTE BREAK

Mission 4: IGNITION Begins in 10 Minutes

Take a break. When you return, we launch.

Next: Hands-On Lab — Deploy OpenCTI, MISP, configure integration, and validate sharing
Ensure your lab environment is ready: Docker Desktop running, repository cloned, or cloud instance accessible

SCORP² Threat Intelligence Architect

🚀 MISSION 4 IGNITION

MISSION 4: IGNITION

Hands-On Lab: Platform Deployment — Launch the Platform

This is launch day. Everything you have learned—doctrine, architecture, sharing governance—comes together now. You will deploy functional OpenCTI and MISP instances, configure bidirectional synchronization, subscribe to TAXII feeds, and validate end-to-end intelligence sharing.

Domain: Hands-On Lab: Platform Deployment
Duration: 60 Minutes
COURSE COMPLETION REQUIREMENT — Participants must successfully complete all hands-on deployment exercises to receive course completion certification
Codename: IGNITION — "Launch the Platform"

SCORP² Threat Intelligence Architect

MISSION 4 OBJECTIVES

What You Will Deploy in IGNITION

1. Deploy OpenCTI via Docker Compose with all required services healthy
2. Deploy MISP via Docker Compose with default feeds and METEORSTORM taxonomy enabled
3. Configure the MITRE ATT&CK connector in OpenCTI for automated framework import
4. Configure OpenCTI-MISP bidirectional synchronization
5. Create indicators and validate cross-platform synchronization
6. Export a STIX 2.1 bundle and demonstrate TLP enforcement

SCORP² Threat Intelligence Architect

LAB ENVIRONMENT

Prerequisites & Setup Options

Before beginning the lab, verify your environment is ready.

Option A: Pre-configured cloud instances (instructor-provisioned AWS/Azure/GCP)
Option B: Local Docker Desktop installation (minimum 8GB RAM allocated to Docker)
Prerequisite: Docker and Docker Compose installed and running
Prerequisite: Internet connectivity for pulling container images
Prerequisite: Terminal/command line access
Prerequisite: Web browser for platform UI access
Prerequisite: Repository URLs and access credentials provided by instructor

SCORP² Threat Intelligence Architect

LAB: OpenCTI DEPLOYMENT

Step 1 of 3 — 20 Minutes

Deploy OpenCTI with all required services and configure the MITRE ATT&CK connector.

Step 1: Clone the OpenCTI Docker repository
Step 2: Configure environment variables: admin credentials, Elasticsearch, Redis, RabbitMQ, MinIO, connector tokens
Step 3: Deploy the platform: docker compose up -d
Step 4: Verify service health — all containers running, UI accessible at port 8080
Step 5: Configure the MITRE ATT&CK connector for automated framework import
Step 6: Create a custom dashboard aligned to one PIR developed in Mission 1
Step 7: Configure a TAXII 2.1 feed subscription from the provided ISAC test feed

Validation: Can you access the OpenCTI dashboard? Is the ATT&CK data populating? Is the TAXII feed connected?

SCORP² Threat Intelligence Architect

LAB: MISP DEPLOYMENT

Step 2 of 3 — 20 Minutes

Deploy MISP with default feeds, METEORSTORM taxonomy, and a configured sharing group.

Step 1: Clone the MISP Docker repository
Step 2: Configure environment variables: MISP admin credentials, MySQL, and base URL
Step 3: Deploy the platform: docker compose up -d
Step 4: Verify service health — all containers running, UI accessible at port 443
Step 5: Enable default threat intelligence feeds and configure synchronization schedule
Step 6: Activate the METEORSTORM taxonomy (Server Settings → Taxonomies → meteorstorm → Enable)
Step 7: Create an event with indicators derived from the course scenario
Step 8: Configure a sharing group aligned to the information handling template from Mission 3

Validation: Can you access the MISP dashboard? Are feeds pulling? Is METEORSTORM active? Is your event created?

SCORP² Threat Intelligence Architect

LAB: INTEGRATION & VALIDATION

Step 3 of 3 — 10 Minutes

Configure bidirectional synchronization and validate end-to-end intelligence sharing.

Step 1: Configure the OpenCTI-MISP connector for bidirectional synchronization
Step 2: Verify that indicators created in MISP appear in OpenCTI (and vice versa)
Step 3: Export a STIX 2.1 bundle from OpenCTI and validate its structure
Step 4: Demonstrate TLP enforcement — verify TLP:RED indicators do not propagate to lower-trust sharing groups
Checkpoint 1 — Cross-platform sync: Create indicator in MISP → confirm appearance in OpenCTI
Checkpoint 2 — STIX export: Download bundle → verify JSON structure and object types
Checkpoint 3 — TLP enforcement: Tag indicator as TLP:RED → verify it does NOT appear in community sharing group

All three validation checkpoints must pass for course completion.

SCORP² Threat Intelligence Architect

TROUBLESHOOTING GUIDE

Common Issues and Resolutions

Container fails to start: Check docker compose logs [service_name]. Verify environment variables. Ensure sufficient RAM allocation.
UI not accessible: Verify port mappings. Check firewall/security group rules. Try alternate browser.
Connector not syncing: Verify API tokens match. Check RabbitMQ queue status. Review connector logs.
TAXII feed timeout: Verify network connectivity. Check TAXII server URL and credentials. Review proxy settings.
TLP enforcement not working: Verify sharing group configuration. Check distribution level settings. Review MISP server synchronization settings.

Instructor support available for deployment issues. Raise hand for assistance.

SCORP² Threat Intelligence Architect

MISSION 4 CHECKPOINT

Course Completion Validation Checklist

☐ OpenCTI deployed and accessible with healthy services
☐ MITRE ATT&CK connector active and populating data
☐ Custom PIR-aligned dashboard created in OpenCTI
☐ MISP deployed and accessible with healthy services
☐ Default feeds enabled and METEORSTORM taxonomy activated
☐ Event created with scenario-derived indicators
☐ Sharing group configured per Mission 3 governance template
☐ OpenCTI-MISP bidirectional sync verified
☐ STIX 2.1 bundle exported and validated
☐ TLP enforcement demonstrated

SCORP² Threat Intelligence Architect

MISSION 4 ASSESSMENT

Three Criteria | Four Proficiency Levels

Criterion 1 — Platform Deployment: Successfully deploys both OpenCTI and MISP with all services healthy and accessible
Criterion 2 — Configuration & Integration: Correctly configures connectors, feeds, taxonomies, dashboards, and bidirectional synchronization
Criterion 3 — Validation & Enforcement: Demonstrates cross-platform indicator sync, valid STIX 2.1 export, and TLP-based distribution control

Proficiency Levels: Emerging | Developing | Proficient | Expert

SCORP² Threat Intelligence Architect

🚀 MISSION 4 IGNITION

MISSION 4: IGNITION — COMPLETE

All four missions are complete. You have mastered doctrine, designed architecture, established governance, and deployed operational platforms. You are a Threat Intelligence Architect.

ORACLE — Complete ✔
FORGE — Complete ✔
NEXUS — Complete ✔
IGNITION — Complete ✔

4 Domains | 4 Missions | Platforms Deployed | Intelligence Flowing

SCORP² Threat Intelligence Architect

COURSE COMPLETE: THREAT INTELLIGENCE ARCHITECT

Four Missions. One Architecture. Operational.

Mission 1: ORACLE — Threat-Informed Defense & Intelligence Planning ✔
Mission 2: FORGE — TIP Architecture & Engineering ✔
Mission 3: NEXUS — M2M Sharing & Space Collective Defense ✔
Mission 4: IGNITION — Hands-On Lab: Platform Deployment ✔

4 Domains | 4 Missions | 2 Platforms Deployed | Intelligence Operational

SCORP² Threat Intelligence Architect

KEY TAKEAWAYS

Five Principles of the Threat Intelligence Architect

1. Doctrine Drives Architecture — Intelligence planning methodology (PIR/EEI/SIR) provides the structure that makes platforms valuable, not just functional
2. Two Platforms, One Mission — OpenCTI for knowledge management and analysis. MISP for community sharing and distribution. Together they create a complete intelligence capability.
3. Sharing is a Force Multiplier — Space Collective Defense transforms isolated defense into sector-wide situational awareness. Machine-to-machine sharing enables this at scale.
4. Governance Enables Trust — Policy, standards, SOPs, and sharing agreements are not bureaucracy—they are the trust framework that makes collective defense possible.
5. From Theory to Operations — Deployed platforms with live data flows are the proof. Theory without deployment is just paperwork.

SCORP² Threat Intelligence Architect

SCORP² PROFESSIONAL DEVELOPMENT PATHWAYS

Your Journey Continues

SCOR Practitioner (Foundations) → 8 hours | 10 domains | Operational foundations
SCORP² Threat Intelligence Architect (This Course) → 4 hours | 4 domains | Intelligence infrastructure
SCORP² Incident Response → Coming soon
SCORP² Security Engineering → Coming soon
SCORP² Policy & Governance → Coming soon

CPE Credits: This course qualifies for 4 CPE credits aligned to NIST NICE PD-WRL-006

Certificate: SCORP² Threat Intelligence Architect course completion certificate issued upon instructor validation.

SCORP² Threat Intelligence Architect

RESOURCES & REFERENCES

Frameworks, Standards, Platforms & Community

METEORSTORM MISP Taxonomy: github.com/MISP/misp-taxonomies/meteorstorm
METEORSTORM GitHub: github.com/h4ck32n4u75/meteorstorm
CJCSM 3314.01A: Intelligence Planning (reference doctrine)
NIST NICE Framework: niccs.cisa.gov/workforce-development/nice-framework
STIX 2.1 Specification: oasis-open.github.io/cti-documentation/stix/intro
TAXII 2.1 Specification: oasis-open.github.io/cti-documentation/taxii/intro
OpenCTI: github.com/OpenCTI-Platform/opencti
MISP: github.com/MISP/MISP
Space ISAC: s-isac.org
ethicallyHackingspace: ethicallyhackingspace.com

SCORP² Threat Intelligence Architect

JOIN THE SPACE COLLECTIVE DEFENSE COMMUNITY

Your Platforms Are Deployed. Your Connections Are Live. Keep Sharing.

You are now part of a growing community of intelligence architects building the shared defense of the space domain.

Space Collective Defense practitioner network — Connect with peers across the sector
Monthly threat intelligence sharing calls — Continued learning and community intelligence
MISP community instance — Continued practice and real-world indicator sharing
Contributor opportunities — METEORSTORM taxonomy development, MISP galaxy clusters, detection rule libraries

SCORP² Threat Intelligence Architect

ASSESSMENT & COMPLETION REQUIREMENTS

What You Need to Earn Your Certificate

1. Attendance — Attend all four instructional domains (Required)
2. Domain I Template Workshop — Complete PIR/EEI/SIR templates (Required)
3. Deploy OpenCTI — Via Docker Compose with functional dashboard (Required)
4. Deploy MISP — Via Docker Compose with configured feeds (Required)
5. Demonstrate Integration — OpenCTI-MISP integration and STIX bundle export (Required)

Certificate: SCORP² Threat Intelligence Architect course completion certificate issued upon instructor validation.

eHs

THANK YOU

SCORP² Threat Intelligence Architect — Course Complete

Advancing Space Collective Defense Through Community-Driven Intelligence Sharing

ethicallyHackingspace (eHs)® | ProofLabs | TLP-GREEN