THREAT INTELLIGENCE
A practical reference for interpreting indicators, assessing confidence and communicating findings.
EVERGREEN ANALYST NOTES · NOT A LIVE THREAT FEED
A domain or IP address is an observable. Its value depends on where it came from, when it was seen and how it relates to the activity being investigated.
Keep timestamps, provenance and limitations alongside every indicator. Reassess before blocking shared infrastructure.
Shared certificates, hosting or page templates may suggest a relationship. They can also reflect shared providers or widely reused tools.
Look for independent corroboration and explain alternative interpretations before making attribution claims.
Confidence should reflect source quality, corroboration and gaps in collection, rather than how serious a finding sounds.
Separate what was directly observed from what was inferred. State what additional evidence would change the assessment.
A USEFUL INTELLIGENCE RECORD
CLARITY BEGINS WITH A QUESTION