# Campaign Tracking and Infrastructure Relationships

> Cluster intrusions into activity groups, read infrastructure relationships without false links, and track campaigns over time and through retooling.

Canonical: https://codelivly.com/rooms/cti-campaign-tracking
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

**Purpose.** Campaign tracking turns separate incidents into an understanding of an operation over time. This module teaches you to define the units you are tracking, cluster incidents with explicit and auditable rules, interpret infrastructure relationships (passive DNS windows, certificates, registration and hosting) without being misled by shared infrastructure, build UTC evidence timelines, and keep tracking an activity group after it changes infrastructure. All case material uses the fictional campaign HARBORLIGHT and the fictional clusters GRANITE HERON, TIDAL LYNX and COPPER WREN.

**Prerequisites.** The CTI Foundations and OSINT and Indicator Analysis learning paths (in particular passive DNS, WHOIS and certificate pivoting), and the earlier modules of this path on ATT&CK, the Diamond Model and attribution limits.

**Measurable outcomes.** After this module you can:
- Distinguish event, intrusion, campaign, activity group and threat actor, and map them to STIX 2.1 objects.
- Classify clustering features as strong or weak and apply a written two-strong-feature rule to a dataset.
- Identify and exclude CDN, shared hosting, sinkhole and parking infrastructure before pivoting.
- Normalise mixed-time-zone evidence to UTC, including DST changes, and calculate dwell time from a stated definition.
- Express overlaps with graded language and track a cluster through retooling using persistent habits.

**Practical completion objective.** Complete both labs: cluster ten synthetic incidents into activity groups with documented linking evidence, and build a UTC evidence timeline for a simulated intrusion with correct ordering and dwell time.

## Lessons

1. Campaigns, Intrusions, Activity Groups and Actors (15 min)
2. Clustering Methodology: Features, Rules and Merge or Split Decisions (18 min)
3. Infrastructure Relationships and False Links (20 min)
4. Lab: Cluster Synthetic Incidents into Activity Groups (50 min)
5. Timelines, Overlaps and Tracking Campaigns Over Time (20 min)
6. Lab: Build an Evidence Timeline from Simulated Security Events (45 min)

## Related

- [Learning path: Threat Actor and Campaign Investigation](https://codelivly.com/learning-paths/cti-threat-actor-investigation)
- [All rooms](https://codelivly.com/rooms)