Threat-Intel Signal Ingest

Convert a threat-intel signal into a queued engagement-scope row that the Exploitability Validation Run (cloud-agent task #3) consumes.

Trigger

Two modes:

• Prompt-invoked: an analyst runs the skill against a signal.json they have on hand.
• Scheduled poll: the cloud-agent runtime polls {OUTPUT_DIR}/inbox/ on a cron (default every 15 minutes) and processes any new signal files it finds.

Workflow

1. Read the payload — tools/ti-ingest.py --in <path-or-stdin>.
2. Validate schema — required keys: signal_id, cve (one or more), assets (one or more), claim. Optional: confidence, source, references.
3. Enrich with NVD — for every CVE in the payload, run tools/nvd-lookup.py <CVE> and attach {score, severity, cwe} to the row.
4. De-dup — skip rows whose (asset, cve) pair already exists in queue/scope-*.json. Re-queue only if the prior row's status is REJECTED AND the TI signal carries a higher confidence than the last attempt.
5. Write queue row — one JSON file per (asset, cve) pair at queue/scope-{ts}-{asset_id}-{cve}.json. The Validation Run task picks these up.

Output