This page issues the course documentation retained by the learner: the workbooks, question sets and reference material for the METEORSTORM overview and Modules 01 to 05, as PDF. Presentation slides are delivered in the course viewer and are not issued here.
Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Definition quoted from FIRST Standards Definitions and Usage Guidance, TLP version 2.0, section 3b.
The mindset
Five mastery areas, each judged against the framework function it is measured by, with the targeting doctrine the model is drawn from named chapter by chapter. It carries no course scenario, so it reads on its own.
Everything to take away from each module you are enrolled in.
↓ Zip this section, 15 files, 1.2 MBThe mindset: five mastery areas, one question, each judged against a framework function.
Its exercises, on the Viasat case and a hypothetical operator.
The data model: five layers, 30 taxonomic elements, published definitions.
Kestrel Orbital Day 1 enumeration: 44 elements, each naming its parent.
AN-THR, AN-ATT, AN-DET, AN-RES, AN-IOC, AN-IOA and their target fields.
The four Kestrel chains, threat to measure, on one element each.
Full text. Binds the command and control path (US).
Full text. Ground-operator duty of care, 24 hour and 72 hour clocks.
The Space ISAC Exchange sharing mandate for the course scenario.
Listed for completeness and excluded from the download above. The same records the reference workbooks print, for a MISP, a SIEM or a spreadsheet, plus the Module 04 rule files. The taxonomy itself is published at MISP/misp-taxonomies, meteorstorm/machinetag.json.
Not the PDF takeaway↓ Zip this section, 26 files,For a MISP, a SIEM or a spreadsheet.
For a MISP, a SIEM or a spreadsheet.
For a MISP, a SIEM or a spreadsheet.
For a MISP, a SIEM or a spreadsheet.
Module 04 RootA rules, one per threat, each naming its playbook.
The approved actions each signature authorizes, with the RACI.
The course output opens in the tool rather than staying a diagram.
METEORSTORM in the workbench analysts already use. The 30 taxonomic elements you enumerate in this course become typed Maltego entities, so a platform decomposition is a graph with enforced parent relationships rather than a diagram. Four right-click transforms traverse the decomposition upward, from asset to service to segment to environment, and a fifth returns live satellite passes from the n2yo public API.
It ships with a worked SATCOM scenario built from CISA and FBI joint advisory AA22-076A. The threats are real and each one quotes the advisory; the platform is a representative architecture that names no operator and resolves to nothing.
TLP:AMBER Full Spectrum Space Cybersecurity Professional