Book
Intelligence-Driven Incident Response
Rebekah Brown and Scott J. Roberts, O'Reilly
How cyber threat intelligence and incident response fit together, through the F3EAD cycle. The book that stops security teams treating OSINT as hobby collecting. Not an OSINT manual.
The second edition, from 2023, is organised around Find, Fix, Finish, Exploit, Analyze, Disseminate: the cycle that turns an incident into intelligence and intelligence into the next detection. It covers the basics of intelligence and of incident response, analytic reasoning and bias, the Kill Chain, Pyramid of Pain, and ATT&CK, then strategic intelligence and building a program. OSINT appears as one input among many.
Worth it if
- You work in a SOC or CTI team and your OSINT findings never change a detection
- You are building or justifying an intelligence program
- You want the analytic frameworks security teams actually use, in one place
- You lead responders and need them to produce intelligence, not just close tickets
Skip it if
- You want to learn OSINT collection; there is no people-search, social, or geolocation content
- You are not in security; the whole frame is incident response
- You dislike non-technical process material; one reviewer found the analysis chapters tedious
What is inside
- 01
Part I: The fundamentals
Introduction, basics of intelligence, basics of incident response.
- 02
Part II: Practical application
Find, Fix, Finish, Exploit, Analyze, Disseminate, one chapter each, with case studies added in the second edition.
- 03
Part III: The way forward
Strategic intelligence and building an intelligence program.
What you will be able to do
- Run an incident so that it produces reusable intelligence
- Apply the Kill Chain, Pyramid of Pain, and ATT&CK to prioritise what matters
- Write intelligence products for different audiences
- Make the case for an intelligence function to leadership
How current it is
The 2023 edition added techniques, lessons, and case studies. Framework books age slowly; nothing here depends on a tool version.
- Updated
- 2nd edition, June 2023
- Maintained
- Updated now and then
How to get the most from it
- 01
Map your last incident to F3EAD
Write down what happened at each stage and where it stopped. Usually it stopped at Exploit.
- 02
Read Part II with a real case open
The chapters are better as a checklist against work in progress than as theory.
- 03
Use Part III for the budget conversation
It is written for the argument you will have with leadership.
Strengths
- Connects collection to outcomes
- The standard CTI and IR reference, recently updated
- Frameworks you will meet in every security job
Limitations
- Not about OSINT technique
- Process-heavy in places
- Assumes a security operations context
Pair it with
- ReadBookPaidIntermediate
Structured Analytic Techniques for Intelligence Analysis
The full catalogue of the analysis methods this book introduces.
- ReadNewsletterFreeIntermediate
Risky Bulletin
The daily feed CTI teams read alongside it.
- ReadCoursePaidIntermediate
SANS SEC497: Practical Open-Source Intelligence
The collection skills this book assumes you have.
FAQ
Questions, answered
Is this an OSINT book?
No. It is a cyber threat intelligence and incident response book in which open sources are one input. It is listed because security teams keep asking how OSINT becomes decisions, and this is the answer.
Is the first edition enough?
The 2017 edition covers the same framework. The 2023 edition adds case studies and lessons from six more years. If you can get the second, do.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days