Sample TLP:CLEAR IOC Handling (Placeholder)
BLUF: This is placeholder content. It models how public posts should defang indicators and label TLP:CLEAR material only.
Context
When publishing threat intelligence to a public blog, all indicators must be defanged so casual readers and automated scanners do not follow live malicious infrastructure.
Example defanged indicators
| Type | Defanged value |
|---|---|
| URL | hxxps://example[.]com/malware/path |
| Domain | evil[.]example |
| IPv4 | 203.0.113[.]45 |
phish[@]example[.]com |
Confidence (placeholder)
We assess with moderate confidence (WEP) that this sample structure follows FIRST TLP 2.0 CLEAR guidance. Replace this section with real analysis once a CTI niche is chosen.
Next steps
- Replace this post with a substantive report from
portfolio/(see PLAN.md). - Cross-link from the resume site Projects section.
- Attach machine-readable artifacts (Sigma, YARA, Navigator JSON) where applicable.