How can cyber defence reporting distinguish policy from an event? An official strategy states intent and a framework; a statement presents its author’s position; technical analysis examines observable evidence. Retain each document’s category and date before connecting its conclusions.
The same technique may appear in different campaigns. Observing it alone cannot identify an actor, sponsor or political intent. A monitoring brief should separate service impact, published technical evidence and attribution statements. Identify missing independent confirmation and the practical consequences for the activity being monitored.
In this topic
Public doctrine · Resilience · Defence · Satellites · Information conflict
Build a cyber defence watch from public sources
How can you monitor cyber defence without confusing signals, communications and evidence? Bound a strategic question, establish a chronology and assess original sources. A useful brief identifies affected infrastructure, civilian dependencies, verified facts and unknowns. It states what would change the assessment and which defensive actions merit review. This guide concerns documentary analysis of public material.
Read the guideIntelligence watch
Open the news desk →Saved headlines · source refresh unavailable · Last successful fetch : Oct 22, 2026, 11:51 PM
Cyber Defense Magazine Names QuSecure Most Innovative In Quantum Security - Quantum Zeitgeist
via Google News · aggregatorUK perspective: Securing and leveraging AI for cyber defence - Deloitte
via Google News · aggregatorVikingCloud Named Hot Company MSSP in Cyber Defense Magazine's 2026 Top InfoSec Innovator Awards - PR Newswire
via Google News · aggregatorExperts question SANDF’s cyber-defence readiness - The South African Star
via Google News · aggregatorSBI’s cyber defences under scrutiny; its Cyber Defence Centre to be operational by FY27 - The Hindu
via Google News · aggregatorReferences: data, uses and limitations
Documentation reviewed on .
| Source and purpose | Verified data or benchmark | How to use it | Limitation to retain |
|---|---|---|---|
| FIRST · Traffic Light Protocol Indicate who may receive redistributed information. |
TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated. | Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity. | TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy. |
| OASIS · STIX 2.1 Describe threat intelligence through structured objects and relationships. |
STIX 2.1 is an OASIS Standard dated 10 June 2021. It defines objects, properties and JSON serialisation. | Keep identifiers, dates, provenance and relationships. Check that the recipient interprets the same object type and validity period. | A syntactically valid object can still be stale, misattributed or weakly supported. |
| MITRE ATT&CK Connect observations with adversary tactics and techniques. |
ATT&CK is a knowledge base grounded in observations. Its domains include Enterprise, Mobile and ICS. | Connect a technique with a trace and detection hypothesis. Distinguish having a log source from actually testing detection. | A shared technique cannot establish actor attribution. Technique coverage counts do not fully measure security. |
STIX indicators and TLP sharing
Connect the indicator to observations and retirement
An indicator match opens an analytical lead. To assess its significance, preserve observed events, technical context, sensor coverage and alternative hypotheses.
- Distinguish Indicator, Observed Data and Sighting; an intelligence assertion does not replace observed data.
- Do not equate a DNS resolution with execution or a Sighting count=0 with worldwide threat absence.
- Assign an owner and a mechanism for retiring derived rules after expiry or revocation.
Read the STIX, observations and TLP sharing reference →
Sources checked on · OASIS · STIX 2.1