## Collection & Sources (OSINT vs. INT)

Where do we get the dirt?

### OSINT (Open Source Intelligence)
*   **Twitter (InfoSec Twitter)**: Often the fastest source. Researchers post "I just found this C2" minutes after detection.
*   **VirusTotal**: The world's malware database.
    *   *Hunting*: "Search for all files that communicate with `bad-domain.com`."
*   **Shodan/Censys**: Search engines for the Internet of Things.
    *   "Show me all servers running vulnerable Exchange 2016 in Germany."
*   **AlienVault OTX (Open Threat Exchange)**: Crowd-sourced pulses.

### Paid Feeds (Commercial)
*   Companies like Recorded Future, Mandiant, Proofpoint.
*   They have spies in Dark Web forums.
*   Value: **Context**. Not just "Block IP X", but "IP X is a Cobalt Strike server rented by Ryuk Ransomware affiliates."

### ISACs (Information Sharing and Analysis Centers)
*   Industry groups (FS-ISAC for Finance, H-ISAC for Health).
*   "We (Bank A) got hit by this. Here are the IOCs so you (Bank B) can block it."
*   *Trust*: High.

### Dark Web (Tor)
*   Monitoring Ransomware leak sites.
*   "Company X has 2 days to pay." -> If Company X is your vendor, you have a Third-Party Risk problem.