TenguProtect · Cyber-defence Library
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026

Intelligence gathering and source validation

G02 · reusable assessment method · Reusable passive discovery with a clear question, provenance and confidence.

Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.

1. Define the intelligence requirement

List the business questions, owned domains, approved public sources and collection end point. Decide how each answer changes the assessment.

Output: intel-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

2. Prepare collectors

Use G03 for theHarvester and Amass; select their documented passive modes and the approved source providers. Use a supplied benign fixture first. Missing provider credits block that source, not the whole report.

Output: test-case.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

3. Collect and preserve references

Record source URL, collection time, observation, candidate asset and confidence. Preserve permitted minimal excerpts or evidence references. Do not build personal password lists or collect unrelated family data.

Output: intel-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

4. Corroborate and deduplicate

Group observations by normalised asset and source; distinguish direct evidence, inference and unverified association. Confirm ownership with the client before active follow-up.

Output: intel-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

5. Return useful findings

Deliver a scoped exposure map with source coverage and unknowns. Link each accepted lead back to its target and parent service step. Do not mark downstream exploitation complete.

Output: findings.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

Use the existing tool guides