*Published: 9/22/2026* ## axioms - intelligence exists to reduce a defender's uncertainty; if it changes no decision, it was noise - an intrusion is ground truth; everything written above it is inference - every report is an intrusion seen through someone's telemetry, and it inherits that telemetry's blind spots - the further a claim sits from telemetry, the more it should be hedged - absence of evidence in your logs is a statement about your logs - novelty and severity are different axes, and one is routinely mistaken for the other - attribution is a working hypothesis, and should be labeled as one - coverage of the news is not coverage of the threat - confidence is a snapshot, thus only instantaneously true --- ## the zen approach to threat intelligence - let the evidence carry the urgency; the writing should stay flat - before adding to a crowded story, have something the existing reports don't - ground every claim in something you saw; when you didn't see it, say so - separate what you know, what you infer, and what you are guessing, and keep the guesses marked - cite whoever saw it first, never the outlet that repeated it - a number without a source is a rumor with a decimal point - name a mitigation the reader can actually deploy, then stop - one mitigation at a chokepoint outweighs a page of indicators - prioritize the behavior over the artifact, because behavior survives tooling changes - lead with what lasts; domains and hashes rot fast, while a protocol quirk or a config fingerprint can hold for a whole campaign - when the industry fixates on the CVE, ask how the intrusion actually started - when two sources disagree, report the disagreement instead of averaging it - say what would change your mind, so the reader knows what to watch for - anchor your words of likelihood; Kent's own board agreed on "serious possibility" while meaning anything from 20 to 80 percent - likelihood and confidence answer different questions; "probably" describes the event, confidence describes the evidence behind it, and a judgment can be probable on thin evidence - pick one phrase per claim and stay with it; drifting from "likely" to "probable" to "we believe" reads as three different judgments - date your confidence; intelligence decays - correct in public; a dated update earns more trust than a quiet edit - restraint reads as credibility over time - clear beats vague, calm holds up better than loud, and useful outlasts impressive --- ## evaluation questions for threat intelligence - Does it **reduce uncertainty** for a defender? - Is it **rooted in an intrusion**? - Did someone observe this, or is it repackaged reporting? - Can you separate what was **seen** from what was **assumed**? - Is it cited to **whoever saw it first**? - Is it **actionable**? - Does it name a **mitigation the reader can deploy**? - Is that mitigation aimed at a **chokepoint**? - Does it lead with indicators that **last**, or ones that rot by next week? - Is the **tone proportionate** to the risk? - Does the urgency come from the evidence itself? - Are you **adding signal**, or repeating what is already out there? - Is your **confidence dated** and scoped to what you saw? - Does it say **what would change your mind**? --- ## end goal confidently answer "yes" to every one of these - Did the right reader get this before they had to decide? - Did they understand it on one read? - Can they act on it without coming back to you? - Will it hold up when the facts firm up? - Is it still useful after the news has moved on? ## references & inspiration - [[Detection Principles]] (the zen approach to detection) - [David Bianco - The Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - [Sherman Kent - Words of Estimative Probability](https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-8-no-4/words-of-estimative-probability/) - [Richards Heuer - Psychology of Intelligence Analysis](https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2/) - [The Zen of Python](https://peps.python.org/pep-0020/)