/21-threat-intelligence

name: Threat Intelligence & CTI
description: Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting
version: 3.1.0
author: Masriyan
tags: [cybersecurity, threat-intelligence, cti, stix, taxii, misp, diamond-model, attribution, ioc, tlp]

Threat Intelligence & CTI

Purpose

Enable Claude to turn raw observations into *finished intelligence* — assessments a defender can act on and decision-makers can trust. This skill governs the whole intelligence cycle: framing requirements, collecting and normalizing indicators, applying structured analytic models, scoring sources and confidence, tracking actors and campaigns, and disseminating in machine-readable (STIX/MISP) and human-readable (report) form.

This is distinct from Skill 06 (Threat Hunting): hunting *uses* intelligence to search an environment for adversary activity; this skill *produces and manages* the intelligence itself. It is also distinct from Skill 05 (Malware Analysis), which produces the technical facts this skill contextualizes and disseminates.

---

Activation Triggers

This skill activates when the user asks about:

• Extracting, defanging/refanging, normalizing, or deduplicating IOCs from reports, emails, or feeds
• Producing a STIX 2.1 bundle, a MISP event, or a TAXII-servable indicator set
• Scoring the reliability of a source or the confidence of an assessment (Admiralty/NATO code, words of estimative probability)
• Applying the Diamond Model, Cyber Kill Chain, or MITRE ATT&CK to structure an intrusion
• Tracking or clustering a threat actor / campaign, or reasoning about attribution
• Writing a tactical, operational, or strategic threat intelligence report or an intelligence estimate
• Setting Priority Intelligence Requirements (PIRs) or building a collection plan
• TLP marking, intelligence dissemination, or feed aging/decay and false-positive suppression
• Enriching an indicator (WHOIS/passive DNS/reputation) or pivoting from one indicator to related infrastructure

---

Prerequisites

python3 --version          # 3.10+; standard library only for the core script
pip install requests       # optional — only for --enrich (live reputation/WHOIS lookups)

**Optional enhanced tooling:**

• `misp` / PyMISP — event creation and sharing on a MISP instance
• `stix2` / `taxii2-client` (OASIS) — richer STIX object modeling and TAXII push/pull
• `opencti` — CTI platform for actor/campaign knowledge-graph management
• A passive-DNS / reputation provider (VirusTotal, Shodan, GreyNoise, urlscan) for enrichment

> **Handling live malware and indicators:** treat sample hashes, live C2 domains, and payload URLs as hostile. Keep them defanged in prose (`hxxp://`, `evil[.]com`), never resolve or fetch them from a production host, and mark sharing scope with TLP before dissemination.

---

Core Capabilities

1. The Intelligence Cycle & Requirements

Anchor every task to where it sits in the cycle, and never skip framing:

1. **Direction** — establish Priority Intelligence Requirements (PIRs). A good PIR is a decision-relevant question with a consumer and a deadline (e.g., "Which ransomware groups actively target our sector's ERP stack this quarter?"), not "tell me about threats." 2. **Collection** — map each PIR to specific sources (internal telemetry, OSINT, commercial feeds, ISAC/sharing communities) and note collection gaps explicitly. 3. **Processing** — normalize, defang, deduplicate, translate, and structure raw data (see §2). 4. **Analysis** — apply structured models (§3) and estimative language (§4); separate *observation* from *assessment*. 5. **Dissemination** — deliver in the form the consumer can use (§5): STIX for machines, a brief for executives, a detection for the SOC. 6. **Feedback** — capture whether the product answered the PIR and refine.

State which stage a request touches and what the governing PIR is before producing output.

2. IOC Extraction, Normalization & Enrichment

**When the user provides a report, email, or blob and asks for indicators:**

1. **Extract** IPv4/IPv6, domains, URLs, email addresses, file hashes (MD5/SHA1/SHA256), CVE IDs, ASNs, registry keys, mutexes, and Bitcoin/crypto addresses. 2. **Refang then re-defang consistently** — accept `hxxp`, `[.]`, `(dot)`, `[at]`, `\.`; internally canonicalize; always emit defanged in prose and clean values only inside structured/quoted fields. 3. **Normalize** — lowercase domains, strip URL fragments/default ports where irrelevant, validate hash length per algorithm, drop obvious noise (RFC 1918/loopback/`example.com`/documentation ranges) unless the user asks to keep them. 4. **Deduplicate & type** each indicator, and attach context: first/last seen, the report it came from, the kill-chain phase it maps to, and a confidence. 5. **Enrich** (optional) — WHOIS/registrar, passive DNS, ASN/geo, reputation, and relationships (this domain resolves to that IP, that IP hosts these other domains) to enable pivoting. 6. Use `scripts/cti_processor.py` for the automatable extraction/defang/normalize/dedup/STIX-export steps; apply human judgment before publishing anything as a confirmed indicator.

3. Structured Analytic Models

Choose the model that fits the question; layer them rather than treating them as alternatives:

• **Diamond Model** — for a single intrusion event, populate the four vertices (adversary, capability, infrastructure, victim) plus meta-features (timestamp, phase, result, direction, methodology). Pivot across vertices to expand knowledge (from one capability to the infrastructure that delivered it, etc.).
• **Cyber Kill Chain** (Lockheed Martin) — sequence observed activity across Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives. Earlier detection is cheaper; note