Full Spectrum Space Cybersecurity Professional

Full Spectrum Course Workbook

METEORSTORM · Overview and Modules 01 to 05

One workbook for the whole course. Follow it module by module as you go, and keep it as a standing reference for running the framework in your own organization after the class.

Exported by verifying identity…

Exported at …

Classification TLP:GREEN · SCORP² community only

Distribution Unauthorized distribution will result in revocation of community membership.

TLP:GREEN Limited Disclosure · SCORP² community members only

Exported by: verifying identity… Exported at: …

Distribution notice. This workbook is for active SCORP² community members only. Unauthorized distribution will result in revocation of community membership.

Your scope: the three requirementsExecutive Order 14144, EU NIS2, and the Space ISAC information-sharing mandate. Equal weight, equal priority.
How to use this workbookFollowing along during class, and using it after.
The data modelThe five layers, the identifier format, the target fields. The shared vocabulary every module builds on.
Overview: the shape of the frameworkThe five functions at altitude, the Pentagon of Pain, and the three entry points.
Module 01 · Concept of Operations (F01)Decompose the platform into PCE / SEG / SVC / AST.
Module 02 · Contextualized Threat Modeling (F02)Anchor each threat (AN-THR) to the element it targets.
Module 03 · Converged Detection Engineering (F03)Map attack paths (AN-ATT) and the data and signal sources to detect each step.
Module 04 · Incident Response Preparation (F04)Write the detection signatures (AN-DET) and the response playbooks.
Module 05 · Adversary Management (F05)Build resilience measures (AN-RES) that shrink the recurring attack surface.
Worked-example referencesSelf-contained printable companions on the Kestrel Orbital enumeration, plus the TEN and ETEN references.
The whole story: Kestrel Orbital end to endThe five function outputs assembled into one continuous worked example.
After the classHow to keep using this workbook in your own organization.

01Your Scope: The Three Requirements

Many rules touch space, and a new team can lose its first year chasing all of them. The scope of this course, and of everything in this workbook, is the three that bind the platform today. They carry equal weight and equal priority. Everything you decompose, model, detect, and harden in the modules ahead is aimed at delivering against all three.

Requirement	Binding in	What it requires
Executive Order 14144	United States	Protect command and control of the space system: encrypt commands, ensure commands are not modified in transit, ensure an authorized party is their source, and reject unauthorized command and control attempts.
EU NIS2 Directive (2022/2555)	European Union	Space is a sector of high criticality. Duties for cryptography and encryption, access control and multi-factor authentication, incident handling, and incident reporting on a 24-hour, 72-hour, and one-month clock.
Space ISAC information sharing	Kestrel Orbital mandate	Establish information sharing with the Space Information Sharing and Analysis Center: membership, a working machine-to-machine connection from the Threat Intel Platform, and contributing to and consuming from the community (#spacecollectivedefense). It carries equal weight to the two regulators.

Why this stays at the front. The three requirements are the scope frame for the whole course. When Security Operations, Satellite Operations, and Satellite Design & Engineering share one language, the evidence you produce once serves both regulators, and what you share with the community leaves already readable. Keep this page in view as you work the modules, so every element you enumerate traces back to a requirement it serves.

02How to Use This Workbook

This is the single workbook for the whole course. It has one section per stage: an overview of the framework, then one section for each of the five modules. Each module section names the concept, the element you produce, the problem it solves, and the worked example and module workbook that go with it.

During class. Open the matching section as each module begins. Read the concept and the element it produces before the module, then use the module workbook link at the bottom of the section to do the hands-on enumeration for that module.

After class. Keep this workbook as your standing reference. The data model in Section 2 and the five module sections are what you return to when you run the framework on your own platform. Create a PDF (toolbar button) and keep it alongside the worked-example references.

03The Data Model

METEORSTORM publishes a controlled, machine-readable vocabulary that every operator, vendor, and peer can read without translation. Four structural layers describe what the platform is; a fifth analytic layer records what defenders observe and build. Every analytic finding attaches back to a real structural element on the platform. This is the vocabulary every module aligns on.

The four structural layers

Code	Layer	Names
PCE	Primary Capability Environment	Where the platform operates (Terrestrial, Aquatic, Aerial, Orbital, Deep Space).
SEG	Segment	Operational role of each enclave (Launch, Link, Ground, User, Aquatic, Low / High / Near Altitude, Space, Deep Space).
SVC	Service	Functional plane the service runs on (Control Plane, Data Plane, Hybrid).
AST	Asset	Concrete element class (Hardware, Firmware, Software, Data, Signal, Hybrid).

The analytic fifth layer

Code	What it enumerates
AN-IOC	Indicator of Compromise. Confirmed indication that a converged space system has been compromised.
AN-IOA	Indicator of Attack. Confirmed indication that a converged space system has been attacked.
AN-ATT	Attack Path. Confirmed attack path for a converged space system.
AN-THR	Threat. Confirmed and active threat against a converged space system.
AN-DET	Detection Signature. Validated, operational pattern, signal, or logic that triggers on contextualized threat behavior.
AN-RES	Resilience Measure. Validated, operational protective capability ensuring resistance to or recovery from confirmed threats.

Element identifier format

LAYER : TAG : LABEL : ORDINAL

All four fields are required, including the LABEL, written in full. Ordinals are scoped to the (LAYER, TAG) pair, so SEG : SP : Space : 00 and SEG : GR : Ground : 00 are distinct entries even though both end in 00. The type dictionary is the TEN reference; a full worked enumeration is the ETEN reference.

Target fields (how analytic findings attach to structural elements)

Field	Used by	What it names
TOE	`AN-IOC`, `AN-IOA`, `AN-ATT`, `AN-THR`	Target of Exploitation. The structural elements observed on or targeted by the analytic entry.
TDM	`AN-DET`	Target of Detection Method. The structural element the signature observes.
TRE	`AN-RES`	Target of Resilience Enhancement. The structural element the measure protects.

Full taxonomy reference. The open-source MISP meteorstorm taxonomy publishes the complete tag set with stable UUIDs. Companion references: Element Taxonomy & Ontology (Layers 1 to 4) and the TEN / ETEN cards.

04Overview: The Shape of the Framework

Before the modules go deep, the overview gives you the whole shape: five functions run in order, five mastery areas they exercise, and three entry points for starting where your organization actually is.

The five functions in order

Code	Function	What it produces
F01	Concept of Operations	The structural decomposition: PCE / SEG / SVC / AST, every child naming its parent.
F02	Contextualized Threat Modeling	Threats (`AN-THR`) anchored via TOE to the element each one targets.
F03	Converged Detection Engineering	Attack paths (`AN-ATT`) plus the data and signal source inventory per step.
F04	Incident Response Preparation	Detection signatures (`AN-DET`) and the paired response playbooks.
F05	Adversary Management	Resilience measures (`AN-RES`) mapped to the four TRE objectives.

The Pentagon of Pain

Five mastery areas where investment provably imposes adversary cost. Each is exercised by one of the five functions.

#	Mastery area	The adversary suffers when…
01	Master Decomposition	…you know your platform better than they ever can.
02	Master Contextualized Threat Modeling	…every strike they imagine is already prepared for.
03	Master Converged Detection Engineering	…they cannot hide, and every move is seen.
04	Master Exposure Management	…every path they take ends in a trap.
05	Master Adversary Management	…their plans are known, broken, and turned against them.

The three entry points

No two organizations sit at the same starting capability. Pick the entry point that matches your current state; the data model stays the same across all three.

Entry point	Best fit	What you do first
Activate	Ops already run; shared vocabulary does not.	Adopt the shared vocabulary inside your existing Threat Intel Platform so every confirmed finding reads the same way for every analyst, vendor, and partner.
Integrate	Platform being designed or rebuilt.	Align Security Operations, Satellite Operations, and Satellite Design & Engineering on the five-function process while the platform is being designed.
Engage	The three teams need to build production work product together.	Run exercises in an environment separate from production with synthetic adversary data, so the signatures, playbooks, and measures graduate straight into production.

05Module 01 · Concept of Operations

F01

Concept of Operations

Decompose the platform, tailored to your requirements.

Produces · PCE / SEG / SVC / AST structural elements

Decompose only what your mission scope requires; you do not have to model the entire platform.
Capture the parent of each part you enumerate so any later finding traces back through the chain you decomposed.
Output: a scoped tree where every part you enumerated has a name, a parent, and a place in the design.

ProblemNo shared structural vocabulary across the operational stack.

SolutionOne framework that names the entire operational stack with one parent-child rule.

Worked example · Element Taxonomy & Ontology, Layer 1 to Layer 4. Type and instance references · TEN / ETEN.

Kestrel Orbital example. The decomposition names the uplink waveform AST:SI:Signal:00, the Link access-control service SVC:CP:Control Plane:05, and the on-board computer AST:HW:Hardware:06, each with its parent.

Follow along. As Module 01 runs, decompose your own platform one layer at a time, naming the parent of every element. Do the hands-on enumeration in the Module 01 workbook.

Keep after class. The scoped decomposition you build here is the anchor every later module attaches to. Update it whenever the platform changes.

06Module 02 · Contextualized Threat Modeling

F02

Contextualized Threat Modeling

Anchor every threat to the telecommand path you just decomposed.

Produces · AN-THR (via TOE)

For every part of the platform, ask which threats actually apply to that specific part.
Anchor each threat to the part it would target, not in the abstract; an orbital threat is not the same as a ground-site threat.
Output: enumerated AN-THR elements where every entry's TOE points back at a real piece of your design.

ProblemThreats tracked as actor names with no link to the platform elements they target.

SolutionEvery AN-THR binds via TOE to specific structural elements; threats anchor or they stay out of the catalog.

Worked example · Contextualized Threat Modeling, Kestrel Orbital.

Kestrel Orbital example. AN:THR:Threat:00 attaches via TOE to PCE:OR:Orbital:00: an actor with demonstrated targeting of satellite command uplinks.

Follow along. Take the decomposition from Module 01 and, element by element, enumerate the threats that anchor to it. Do the hands-on work in the Module 02 workbook.

Keep after class. Your AN-THR catalog is only as good as its anchoring. Any threat that cannot name a TOE does not belong in the catalog.

07Module 03 · Converged Detection Engineering

F03

Converged Detection Engineering

Enumerate attack paths and the data and signals needed to detect each step.

Produces · AN-ATT + data and signal source inventory

For each cataloged threat, trace how an adversary could move through the platform to make it real.
For each step on each path, enumerate the data and signal sources needed to observe it; where no source exists, the gap is itself a finding the team must close before launch.
Output: a map of every path plus the data and signal source inventory the next module uses to write signatures and playbooks.

ProblemDetection rules written before attack paths and source inventory exist.

SolutionEvery adversary move chained, every data and signal source inventoried.

Worked example · Converged Detection Engineering, Kestrel Orbital.

Kestrel Orbital example. AN:ATT:Attack Path:00 runs AST:SI:Signal:00 to SVC:CP:Control Plane:05 to AST:HW:Hardware:06: an unauthenticated telecommand reaching the on-board computer.

Follow along. For each Module 02 threat, chain the attack path and inventory the source needed at every step. Do the hands-on work in the Module 03 workbook.

Keep after class. A source gap on any step is a detection blind spot. Track the gaps as work items, not footnotes.

08Module 04 · Incident Response Preparation

F04

Incident Response Preparation

Write the detection signatures and the response playbooks.

Produces · AN-DET (via TDM) + response playbooks

For every step on every attack path, write the detection signature that fires on the data or signal source the previous module delivered.
For every signature, write the response playbook the Security Operations Center runs the moment the signature fires.
Output: tested detection signatures in an open format (RootA) and the playbooks they trigger, each tied back to the attack path it covers. No orphan signatures, and no signature without a playbook.

ProblemVendor-locked signatures with no paired response playbook for the SOC.

SolutionSignatures in RootA, paired with response playbooks, every one linked to an attack-path step.

Worked example · Incident Response Preparation, Kestrel Orbital.

Kestrel Orbital example. AN:DET:Detection Signature:00 attaches via TDM to SVC:CP:Control Plane:05: a RootA rule firing on repeated uplink authentication failures.

Follow along. Turn each Module 03 path step into a signature, then pair each signature with a playbook. Do the hands-on work in the Module 04 workbook.

Keep after class. Every signature carries a TDM and a playbook. Retire the pair together when the underlying path is closed.

09Module 05 · Adversary Management

F05

Adversary Management

Shrink the attack surface the threats keep using.

Produces · AN-RES (via TRE) + adversary profile

Identify the structural elements that show up across many threats and many attack paths.
Build resilience measures that shrink, harden, or eliminate those elements before launch, mapped to one of four TRE objectives (per NIST SP 800-160 v2): Anticipate, Withstand, Recover, Adapt.
Split each measure across two timelines: immediate compensating controls owned by Security Operations and Satellite Operations, and engineering remediation owned by Satellite Design & Engineering. The bridging control retires when the long-term fix lands.

ProblemThe same adversary returns; the same flaw stays exposed; no shared posture across the three teams.

SolutionProfile the adversary, locate the leverage, coordinate the fix across SOC, SatOps, and SatDev/Eng.

Worked example · Adversary Management + Adversary Profile, Kestrel Orbital.

Kestrel Orbital example. AN:RES:Resilience Measure:00 attaches via TRE to SVC:CP:Control Plane:01: enforce telecommand authentication; goal Withstand.

Follow along. Find the elements that recur across your paths and build the measures that shrink them. Do the hands-on work in the Module 05 workbook.

Keep after class. Each AN-RES names a TRE and one of the four objectives. This is where the program stops reacting and starts reducing the surface.

10Worked-Example References

Each worked example is a self-contained printable companion on the Kestrel Orbital enumeration, following one telecommand thread across the functions. Pull them alongside this workbook when you want to see what a full, anchored analytic entry looks like.

Reference	What it demonstrates
Element Taxonomy & Ontology	The full four-layer structural decomposition with the element enumeration process and annotation criteria.
TEN reference	The published type definitions for all five layers, quoted verbatim.
ETEN reference	A full worked enumeration: the 51-element Kestrel Orbital Day-1 CONOPS.
Contextualized Threat Modeling	One concrete `AN-THR` anchored via TOE to the orbital command environment, acting on the telecommand uplink waveform.
Converged Detection Engineering	One concrete `AN-ATT` for the telecommand-injection chain (uplink, Link access-control, on-board computer), with the source inventory per step.
Incident Response Preparation	One enumerated `AN-DET` in RootA YAML for the unauthenticated telecommand, with TDM attachment and a paired response playbook.
Adversary Management + Adversary Profile	One enumerated `AN-RES` for enforced telecommand authentication plus the adversary-profile template.

11The Whole Story: Kestrel Orbital, End to End

By the end of the course you have run all five functions on one platform, Kestrel Orbital. Read top to bottom, the five outputs assemble into one continuous account: decompose the platform, name the threat, trace the path, detect the step, and harden the element. Every finding names a real structural element from the Day-1 CONOPS.

Function	Kestrel Orbital finding	Element it names
F01	Decompose the platform into PCE / SEG / SVC / AST, every child naming its parent.	AST:SI:Signal:00, SVC:CP:Control Plane:05, AST:HW:Hardware:06
F02	`AN:THR:Threat:00`, an actor with demonstrated targeting of satellite command uplinks.	TOE → PCE:OR:Orbital:00
F03	`AN:ATT:Attack Path:00`, an unauthenticated telecommand reaching the on-board computer.	TOE → AST:SI:Signal:00, SVC:CP:Control Plane:05, AST:HW:Hardware:06
F04	`AN:DET:Detection Signature:00`, a RootA rule on repeated uplink authentication failures.	TDM → SVC:CP:Control Plane:05
F05	`AN:RES:Resilience Measure:00`, enforce telecommand authentication; goal Withstand.	TRE → SVC:CP:Control Plane:01

One platform, one vocabulary, one story. The same structural elements appear in row after row, so the threat, the path, the detection, and the resilience measure all point at the same parts of Kestrel Orbital. That is what lets Security Operations, Satellite Operations, and Satellite Design & Engineering read one another's work without re-translation. The standalone worked examples for each function are linked in the previous section.

12After the Class

The course ends; the workbook does not. Everything you need to run the framework on your own platform is in the sections above.

Create a PDF (toolbar button) and keep it with the worked-example references.
Use Section 2 as the reference card for your team when you adopt the METEORSTORM vocabulary in your own Threat Intel Platform.
Work the five module sections in order on your own platform: decompose (F01), anchor threats (F02), chain paths (F03), write signatures and playbooks (F04), then reduce the recurring surface (F05).
Pair with the open-source MISP meteorstorm taxonomy (machinetag.json) when you onboard new analysts.

One shared vocabulary. The value of the framework is that Security Operations, Satellite Operations, and Satellite Design & Engineering all read the same elements the same way. Keep this workbook current and every team stays aligned on the same platform picture.

Full Spectrum Course Workbook

Contents

01Your Scope: The Three Requirements

02How to Use This Workbook

03The Data Model

The four structural layers

The analytic fifth layer

Element identifier format

Target fields (how analytic findings attach to structural elements)

04Overview: The Shape of the Framework

The five functions in order

The Pentagon of Pain

The three entry points

05Module 01 · Concept of Operations

06Module 02 · Contextualized Threat Modeling

07Module 03 · Converged Detection Engineering

08Module 04 · Incident Response Preparation

09Module 05 · Adversary Management

10Worked-Example References

11The Whole Story: Kestrel Orbital, End to End

12After the Class