pilot-threat-intelligence-setup

To orchestrate a threat intelligence pipeline for IOC aggregation, you deploy a four-role architecture comprising collector, enricher, analyzer, and distributor agents. This structure standardizes data flows for raw IOCs, enriched IOCs, and threat verdicts with MITRE mappings across distributed agents.

The best way to distribute threat intelligence using STIX/TAXII publishing is through a dedicated distributor agent within a four-node pipeline. This agent handles the final distribution of analyzed indicators of compromise after upstream collection, enrichment, and analysis roles process the raw data.

Yes, you need a running Pilot daemon to set up threat intelligence collection agents. The pipeline requires pilot-protocol skills, the pilotctl binary, and clawhub to coordinate roles, assign hostnames, and establish conflict-free handshakes across distributed agents.

The MITRE ATT&CK mapping process works within a threat intelligence workflow by passing enriched IOCs through a dedicated analyzer agent. This role processes enriched indicators to generate threat verdicts mapped to MITRE ATT&CK techniques before final STIX/TAXII distribution.

Yes, you can use clawhub to install role-specific skills for security operations. The setup involves installing the four role-specific threat intelligence skills via clawhub, configuring each agent's hostname, and writing the threat-intelligence manifest to the agent configuration.

The primary limitation of a four-node threat intelligence pipeline is its dependency on specific infrastructure, requiring the pilotctl binary, clawhub, pilot-protocol skills, and a running Pilot daemon to coordinate the collector, enricher, analyzer, and distributor roles without conflicts.