Threat Intelligence & CTI

Evidence contract

Script output contract (3.2)

cti_processor.py accepts text and produces extraction candidates. Its extraction_confidence describes recognition only; maliciousness_confidence is null until independently assessed. detection_readiness is needs-review. STIX exports are neutral cyber-observable objects with TLP 2.0 statement markings; MISP-style exports keep to_ids false. Unsupported STIX types are explicitly listed in bundle metadata. Preserve the full plugin checkout for shared utilities.