What problem does it solve?
CTI teams often collect feeds without direction, produce reports nobody acts on, and cannot demonstrate program value. This Skill structures the full intelligence lifecycle so every collection source traces to a Priority Intelligence Requirement (PIR) and every product reaches the right audience with measurable feedback.
Core Features & Use Cases
- PIR Definition & Collection Mapping: Facilitates stakeholder interviews to define 5-10 quarterly PIRs and maps each to technical, human, and internal collection sources while documenting coverage gaps.
- Three-Level Intelligence Production: Guides production of strategic (quarterly executive), operational (weekly campaign), and tactical (daily IOC) products using structured analytic techniques like ACH and Key Assumptions Check.
- Dissemination & Feedback Loops: Matches product formats to audiences (PDFs for executives, Sigma rules and MISP events for SOC), applies TLP classifications, and tracks metrics like PIR coverage rate and IOC true-positive rate.
- Use Case: A security director establishing a new CTI program uses this Skill to run a quarterly requirements review, align MISP feed ingestion to documented PIRs, and set up a stakeholder satisfaction survey to prove program value.
Quick Start
Help me define Priority Intelligence Requirements for our CTI program and map our existing threat feeds to them.
