NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Campaign Tracking and Infrastructure Relationships
Cluster intrusions into activity groups, read infrastructure relationships without false links, and track campaigns over time and through retooling.
Room tasks
1Campaigns, Intrusions, Activity Groups and Actors
2Clustering Methodology: Features, Rules and Merge or Split Decisions
3Infrastructure Relationships and False Links
4Lab: Cluster Synthetic Incidents into Activity Groups
5Timelines, Overlaps and Tracking Campaigns Over Time
6Lab: Build an Evidence Timeline from Simulated Security Events
Campaign Tracking and Infrastructure Links | Codelivly
Frequently Asked Questions
What is campaign tracking in threat intelligence?
Campaign tracking groups related intrusions over time by shared infrastructure, tooling and behavior, helping analysts understand how an adversary operates and anticipate what they may do next.
What is an activity cluster?
An activity cluster is a set of related events grouped by shared characteristics before it is confidently tied to a known actor. It lets analysts track behavior without making premature attribution claims.
How do I avoid false links between infrastructure?
Check whether infrastructure is shared hosting or reused by many parties, and look for corroborating evidence. The Codelivly room is free and hands-on, showing how to read relationships carefully.