generating-threat-intelligence-reports

name	generating-threat-intelligence-reports
description	Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments.
domain	cybersecurity
tags	["CTI","threat-intelligence","intelligence-products","TLP","PIR","report-writing","NIST-CSF"]
subdomain	threat-intelligence
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Generating Threat Intelligence Reports

Overview

Cybersecurity skill for generating threat intelligence reports. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "generating threat intelligence reports"
• "Producing weekly, monthly, or quarterly threat intelligence summaries for securi"
• "Creating a rapid intelligence assessment in response to a breaking threat (e"
• "Generating sector-specific threat briefings for executive decision-making on sec"

Use this skill when:

• Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership
• Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign)
• Generating sector-specific threat briefings for executive decision-making on security investments

Do not use this skill for raw IOC distribution — use TIP/MISP for automated IOC sharing and reserve report generation for analyzed, finished intelligence.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Completed analysis from collection and processing phase (PIRs partially or fully answered)
• Audience profile: technical level, decision-making authority, information classification clearance
• TLP classification decision for the product
• Organization-specific reporting template aligned to audience expectations

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}