Tutorials

A practical approach to modelling Admiralty Codes in STIX 2.1 using Marking Definitions and Extension Definitions, with reusable objects you can adopt in your own CTI workflows.

Learn how to avoid ad-hoc custom objects by generating schemas and Extension Definitions automatically with stix2extensions, keeping STIX extensions interoperable by default.

An ATT&CK-native introduction to MITRE D3FEND: how defensive tactics, techniques, artefacts, and relationships mirror attacker behavior and complete the picture.

This proof of concept shows how adversarial prompts from PromptIntel can be transformed into structured STIX intelligence by treating prompts as observables and NOVA rules as behavioural Indicator logic.

The ATT&CK Navigator isn’t limited to ATT&CK. In this post, we break down the STIX properties the Navigator actually uses and show how to build a custom MITRE ATLAS matrix that renders cleanly inside it.

Obstracts is the blog feed reader used by the worlds most targetted cyber-security teams. Let me show you why.

MITRE ATT&CK techniques are useful, but they don’t capture the sequence of an attack. Enter Attack Flows.

Learn how to seamlessly convert Sigma Rules into queries for your SIEM. Follow along with real examples.

Correlation Rules allow you to detect threats by linking multiple events together based on a meaningful relationship.

Sigma Rules are becoming more widely adopted as the standard detection language. Learning how to write them is not difficult. Let me show you.

We do a lot of our research into vulnerabilities. To aid this, we enrich CVEs using many remote sources of intelligence. Here is a walk-through showing how we connect CVEs to EPSS scores, CISA KEVs, MITRE ATT&CK, CWEs, and CAPECs.

Developing on last weeks post, I show you how to construct STIX Patterns to automatically flag which products are affected by published CVEs.

Our intel team is increasingly using the DISARM framework to classify parts of our research as disinformation campaigns continue increase. In this post I will introduce the DISARM data structure.

Take the list of recognised countries and regions. Create STIX objects for them. Make them available to everyone so that the CTI world has a single way of representing them.

The MITRE ATT&CK Navigator is a very useful tool to explore the MITRE ATT&CK (and other similar frameworks). In this post I take a look what you can do with Navigator and how it works under the hood so that you can use it to model your own ATT&CK-like frameworks.

A practical Workbench guide: extend ATT&CK, link objects to techniques, and publish collections other teams and tools can consume.

Learn how to translate STIX detection patterns into SIEM queries using STIX Shifter, and convert detections back into STIX Observed Data for evidence and correlation.

Learn how to turn threat intelligence into actionable detection rules. Learn how to build behavioral detection using STIX Patterns, and link sightings to evidence.

A practical guide to storing and querying STIX 2.1 data using MemoryStore, FileSystemStore, and ArangoDB — with Python examples.

How to design and ship STIX 2.1 extensions — new objects, nested props, and bundles — that your consumers will love.

All I wanted was EPSS and CVSS to show up in OpenCTI. Instead, I ended up reverse-engineering half its schema and building new STIX Extensions from scratch. Here’s the mildly painful but oddly satisfying journey.

The fast, code-first way to generate valid STIX 2.1 threat intelligence in Python. Covers SDOs, SCOs, relationships, versioning, and bundling — everything you need to start building and sharing structured intel like a pro.

Forget the 50-page spec. This guide explains STIX 2.1 objects—SDOs, SCOs, SROs, SMOs, and Bundles—in plain English with real threat intel examples.