threat-intelligence--cti

# Threat Intelligence & CTI ## Purpose Enable Claude to turn raw observations into *finished intelligence* — assessments a defender can act on and decision-makers can trust. This skill governs the whole intelligence cycle: framing requirements, collecting and normalizing indicators, applying structured analytic models, scoring sources and confidence, tracking actors and campaigns, and disseminating in machine-readable (STIX/MISP) and human-readable (report) form. This is distinct from Skill 06 (Threat Hunting): hunting *uses* intelligence to search an environment for adversary activity; this skill *produces and manages* the intelligence itself. It is also distinct from Skill 05 (Malware Analysis), which produces the technical facts this skill contextualizes and disseminates. --- ## Activation Triggers This skill activates when the user asks about: - Extracting, defanging/refanging, normalizing, or deduplicating IOCs from reports, emails, or feeds - Producing a STIX 2.1 bundle, a MISP event, or a TAXII-servable indicator set - Scoring the reliability of a source or the confidence of an assessment (Admiralty/NATO code, words of estimative probability) - Applying the Diamond Model, Cyber Kill Chain, or MITRE ATT&CK to structure an intrusion - Tracking or clustering a threat actor / campaign, or reasoning about attribution - Writing a tactical, operational, or strategic threat intelligence report or an intelligence estimate - Setting Priority Intelligence Requirements (PIRs...