skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

opentide-threat-vector

Convert CTI reports into TVM YAML with ATT&CK mappings and UUIDs.

4|1|Updated Apr 28, 2026
Search Tags:#yaml#threat-modeling#threat-intelligence#mitre-attack#cti#tvms
One-click install
npx skills add https://github.com/OpenTideHQ/AgentTide --skill opentide-threat-vector
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: opentide-threat-vector
Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/opentide-threat-vector
Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill opentide-threat-vector

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Structures threat intelligence into evidence-backed behavioural atoms and authors OpenTide Threat Vector (TVM) YAML (tvm schemas), including metadata, terrain, chaining, ATT&CK, UUIDs. Covers Phase A intelligence structuring (source hygiene, atomisation, gap analysis) and Phase B schema-backed YAML authoring (field-level guidance, quality patterns, anti-patterns distilled from production corpora). Use whenever work involves converting CTI into TVMs, creating or refactoring files under Threat Vectors, or when the user provides reports, feeds, or narratives before detection objectives exist.

Core Features & Use Cases

  • Phase A — Intelligence structuring: source hygiene, facts versus inference, atomisation, ATT&CK mapping notes, gap checklist, credibility assessment, IOC hygiene.
  • Phase B — TVM YAML authoring: load live schemas, enforce Object conventions, top-level fields, metadata, threat content; includes preconditions and hand-off from Phase A.
  • Use Case: Convert a CTI report into a TVM YAML draft to be integrated into detection workflows.

Quick Start

Load a CTI report and generate a Phase A intelligence outline and a Phase B TVM YAML draft.

Frequently Asked Questions about opentide-threat-vector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert CTI reports into structured threat models?▼

To convert CTI reports into structured threat models, you can load raw intelligence data into a tool that applies source hygiene, atomization, and ATT&CK mapping to generate TVM YAML drafts for detection workflows.

What is the best way to author TVM YAML for threat intelligence?▼

The best way to author TVM YAML is to use schema-backed generation that enforces object conventions, metadata standards, terrain preconditions, and UUID generation to ensure structured threat modeling outputs.

How does MITRE ATT&CK mapping work with threat vector YAML?▼

MITRE ATT&CK mapping integrates with threat vector YAML by structuring raw CTI data into evidence-backed behavioral atoms during intelligence triage, which are then translated into schema-compliant TVM files.

Can I use raw threat intelligence feeds to generate threat models?▼

Yes, you can use raw threat intelligence feeds to generate threat models by processing them through an intelligence structuring phase that separates facts from inferences and performs IOC hygiene before YAML authoring.

What are the limitations of manually creating threat vector YAML?▼

Manually creating threat vector YAML often leads to schema inconsistencies, missing UUIDs, and poor terrain precondition mapping, which automated structuring and gap analysis phases are designed to identify and resolve.

Do I need to perform gap analysis before authoring threat vector YAML?▼

Yes, performing gap analysis before authoring threat vector YAML is required to assess credibility, separate facts from inferences, and ensure the resulting threat models are evidence-backed and structurally complete.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
daemon-blockint-techdaemon-blockint-tech
7

threat-hunter

Validate adversary hypotheses across enterprise telemetry using MITRE ATT&CK mapping.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
MHaggisMHaggis
471

cti-detection-engineer

Generate multi-SIEM detection logic from threat intelligence and MITRE ATT&CK mappings.

Community
Advanced