Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.
The threat intelligence lifecycle is a structured, iterative process for transforming raw data into actionable intelligence. Based on the intelligence cycle used by military and government agencies, it comprises six phases: Direction (requirements gathering), Collection (data acquisition), Processing (normalization and deduplication), Analysis (contextualization and assessment), Dissemination (distribution to stakeholders), and Feedback (evaluation and refinement). This skill covers building each phase with tooling, metrics, and integration points for a mature CTI program.
When to Use
When deploying or configuring implementing threat intelligence lifecycle management capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
Collection without PIRs: wiring up CISA KEV, OTX, and MalwareBazaar feeds before defining Priority Intelligence Requirements produces data overload and no answers. Map every collection source to a PIR or drop it.
Processing stage skipped: feeding raw collection straight to analysis without the normalize → dedup → enrich → score pipeline floods analysts with duplicates. Confirm the dedup hash keys on type:value:source so distinct-context IOCs are not over-merged.
Confidence/TLP defaults unset:_normalize() defaulting confidence to 50 and TLP to green means unscored, freely-shareable indicators leak downstream. Set these explicitly per source.
No feedback loop: dissemination without the feedback stage means products are never validated against PIRs - wire collect_feedback() to a defined SLA.
Indicator expiry ignored: tagging with a collection date but no TTL/expiration lets stale IOCs persist in the SIEM. Add decay handling.
Verification: confirm each active PIR maps to >=1 collection source, the pipeline reports duplicates removed, analysis output references a specific requirement_id, and distribution metrics show products reaching each stakeholder channel.
Prerequisites
Python 3.9+ with pymisp, stix2, requests, pandas libraries
MISP or OpenCTI as threat intelligence platform
Ticketing system (Jira, ServiceNow) for requirements management
SIEM integration (Splunk, Elastic) for indicator operationalization
Understanding of intelligence analysis techniques (ACH, Diamond Model)
Key Concepts
Intelligence Requirements (IR)
Priority Intelligence Requirements (PIRs) define what the organization needs to know. Examples: Which threat actors target our sector? What vulnerabilities are being actively exploited? Are our brand or credentials being traded on dark web? PIRs drive collection planning and ensure intelligence production is relevant.
Collection Management Framework
A collection management framework maps intelligence requirements to collection sources, tracks collection gaps, and ensures coverage across the threat landscape. Sources include OSINT, commercial feeds, ISAC sharing, internal telemetry, and human intelligence from industry contacts.
