OSINT

Instructions: Identify an organization that you will investigate over the course labs. However, do not choose a government organization, individual, or entity that may be considered a violation of privacy.

Task: Identify 15 factors about the organization that could provide information about the organization, and how you would research these.

Submittal: Submit using the Grid Association Matrix.

Using the organization identified from Lab 1, identify what items would you would want to include in your chosen organization’s collection plan. Additionally, you will want to identify what you expect to gain/monitor with the collection plan.

Task: Start to develop a 1300 word document data collection plan. Include any information/content you needed to be included in your collection plan, why you selected this information, and more importantly what you expect to be able to present to leadership through the collection plan.

Previous

Next

STUDENT USE ONLY

Copyright 2020, Ervin Frenzel

Student:

(LastName)_____________________(FirstName)_______________

Class______________________Section______________Semester:___________________

Week:________________Project:___________________________________

Copyright 2020, Ervin Frenzel

Instructions:

For identifying SIEM/Security products:

Identify and rank 10 components (data sets or logs) that can be imported to a SIEM – rank them

upon, do this with 2 separate SIEM products (LogRythm, Splunk, QRadar, ArcSight, AlienVault,

NuSiem, Dell SecureWorks, Rapid 7) Rank according to Application Programming Interface

(API):

API rating “0” – Data integration is not possible with non-proprietary data sets

API rating “1” – manual retrieval of information

API rating “2” – We can produce API

API rating “3” – Community will produce API

API rating “4” – Organization will produce and deploy API

API rating “5” – Existing API produced and backed by Vendor

For Cost Associations (Highest cost to Lowest cost):

1 – ________________ to _________________ (example over $50,000)

2 – ________________ to _________________ (example $40,000 to $49,999)

3 – ________________ to _________________ (example $25,000 to $39,999)

4 – ________________ to _________________ (example $10,000 to $24,999)

5 – ________________ to _________________ (example under $9,999)

For Identifying Indicators of Compromise (IoC):

Rank according

1 – No association (validated or confirmed)

2 – Suspected not association

3 – Association unknown (status unknown)

4 – Suspected association

5 – Association confirmed (validated or confirmed)

1. LastName:
2. FirstName:
3. Class:
4. Section:
5. Semester:
6. Week:
7. Project:
8. 1:

to:

9. 2:
10. to_2:
11. 3:
12. to_3:
13. 4:
14. to_4:
15. 5:
16. to_5:
17. Value 1:

0:
0:
1:
2:
3:
4:
5:
6:
1:
0:
1:
2:
3:
4:
5:
6:
2:
0:
1:
2:
3:
4:
5:
6:
3:
0:
1:
2:
3:
4:
5:
6:
4:
0:
1:
2:
3:
4:
5:
6:
5:
0:
1:
2:
3:
4:
5:
6:
6:
0:
1:
2:
3:
4:
5:
6:
7:
0:
0:
1:
1:
0:
1:
2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:
0:
1:

8:
0:
0:
1:
1:
0:
1:
2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:
0:
1:

9:
0:
0:
1:
1:
0:
1:
2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:
0:
1:

10:
0:
0:
1:
1:
0:
1:
2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:
0:
1:

11:
0:
0:
1:
1:
0:
1:
2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:
0:
1:

12:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

13:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

14:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

15:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

16:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

17:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

18:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

19:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

20:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
0:
1:
0:
1:

6:
0:
1:
0:
1:

21:
0:
0:
1:
1:
0:
1:
0:
1:

2:
0:
1:
0:
1:

3:
0:
1:
0:
1:

4:
0:
1:
0:
1:

5:
1:
0:
0:
1:
1:
0:
1:

0:
0:
1:

22:
0:
0:
1:
0:
1:
2:
0:
1:

1:
0:
0:
1:
1:
0:
1:
2:
0:
1:

2:
0:
0:
1:
1:
0:
1:
2:
0:
1:

3:
0:
0:
1:
1:
0:
1:
2:
0:
1:

4:
2:
0:
0:
1:
1:
0:
1:

0:
0:
1:
1:
0:
1:

5:
2:
0:
0:
1:
1:
0:
1:

0:
0:
1:
1:
0:
1:

Lavf58.12.100