Recognizing Threat Indicators (part 1)