Threat Intelligence

Purpose

Manage cyber threat intelligence operations including feed management, IoC/TTP handling, threat hunting, and MITRE ATT&CK mapping. Provide actionable intelligence to SIEM detection rules, SOC operations, and risk management decisions.

Agent Protocol

Trigger

• "threat intelligence", "CTI", "threat feed", "threat intel", "intelligence"
• "IoC", "indicator of compromise", "TTP", "MITRE ATT&CK", "attack chain"
• "threat hunting", "hunt hypothesis", "proactive hunting"
• "intelligence lifecycle", "strategic intelligence", "tactical intelligence"
• "threat actor", "campaign", "TTP mapping", "threat landscape"