generating-threat-intelligence-reports
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
Best use case
generating-threat-intelligence-reports is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
Teams using generating-threat-intelligence-reports should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/generating-threat-intelligence-reports/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How generating-threat-intelligence-reports Compares
| Feature / Agent | generating-threat-intelligence-reports | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Generating Threat Intelligence Reports ## When to Use Use this skill when: - Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership - Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign) - Generating sector-specific threat briefings for executive decision-making on security investments **Do not use** this skill for raw IOC distribution — use TIP/MISP for automated IOC sharing and reserve report generation for analyzed, finished intelligence. ## Prerequisites - Completed analysis from collection and processing phase (PIRs partially or fully answered) - Audience profile: technical level, decision-making authority, information classification clearance - TLP classification decision for the product - Organization-specific reporting template aligned to audience expectations ## Workflow ### Step 1: Determine Report Type and Audience Select the appropriate intelligence product type: **Strategic Intelligence Report**: For C-suite, board, risk committee - Content: Threat landscape trends, adversary intent vs. capability, risk to business objectives - Format: 1–3 pages, minimal jargon, business impact language, recommended decisions - Frequency: Monthly/Quarterly **Operational Intelligence Report**: For CISO, security directors, IR leads - Content: Active campaigns, adversary TTPs, defensive recommendations, sector peer incidents - Format: 3–8 pages, moderate technical detail, mitigation priority list - Frequency: Weekly **Tactical Intelligence Bulletin**: For SOC analysts, threat hunters, vulnerability management - Content: Specific IOCs, YARA rules, Sigma detections, CVEs, patching guidance - Format: Structured tables, code blocks, 1–2 pages - Frequency: Daily or as-needed **Flash Report**: Urgent notification for imminent or active threats - Content: What is happening, immediate risk, what to do right now - Format: 1 page maximum, distributed within 2 hours of threat identification - Frequency: As-needed (zero-day, active campaign targeting sector) ### Step 2: Structure Report Using Intelligence Standards Apply intelligence writing standards from government and professional practice: **Headline/Key Judgment**: Lead with the most important finding in plain language. - Bad: "This report examines threat actor TTPs associated with Cl0p ransomware" - Good: "Cl0p ransomware group is actively exploiting CVE-2024-20353 in Cisco ASA devices to gain initial access; organizations using unpatched ASA appliances face imminent ransomware risk" **Confidence Qualifiers** (use language from DNI ICD 203): - High confidence: "assess with high confidence" — strong evidence, few assumptions - Medium confidence: "assess" — credible sources but analytical assumptions required - Low confidence: "suggests" — limited sources, significant uncertainty **Evidence Attribution**: Cite sources using reference numbers [1], [2]; maintain source anonymization in TLP:AMBER/RED products. ### Step 3: Write Report Body Use structured format: **Executive Summary** (3–5 bullet points): Key findings, immediate business risk, top recommended action **Threat Overview**: Who is the adversary? What is their objective? Why does this matter to us? **Technical Analysis**: TTPs with ATT&CK technique IDs, IOCs, observed campaign behavior **Impact Assessment**: Potential operational, financial, reputational impact if attack succeeds **Recommended Actions**: Prioritized, time-bound defensive measures with owner assignment **Appendices**: Full IOC lists, YARA rules, Sigma detections, raw source references ### Step 4: Apply TLP and Distribution Controls Select TLP based on source sensitivity and sharing agreements: - **TLP:RED**: Named recipients only; cannot be shared outside briefing room - **TLP:AMBER+STRICT**: Organization only; no sharing with subsidiaries or partners - **TLP:AMBER**: Organization and trusted partners with need-to-know - **TLP:GREEN**: Community-wide sharing (ISAC members, sector peers) - **TLP:WHITE/CLEAR**: Public distribution; no restrictions Include TLP watermark on every page header and footer. ### Step 5: Review and Quality Control Before dissemination, apply these checks: - **Accuracy**: Are all facts sourced and cited? No unsubstantiated claims. - **Clarity**: Can the target audience understand this without additional context? - **Actionability**: Does every report section drive a decision or action? - **Classification**: Is TLP correctly applied? No source identification in AMBER/RED products? - **Timeliness**: Is this intelligence still current? Events older than 48 hours require freshness assessment. ## Key Concepts | Term | Definition | |------|-----------| | **Finished Intelligence** | Analyzed, contextualized intelligence product ready for consumption by decision-makers; distinct from raw collected data | | **Key Judgment** | Primary analytical conclusion of a report; clearly stated in opening paragraph | | **TLP** | Traffic Light Protocol — FIRST-standard classification system for controlling intelligence sharing scope | | **ICD 203** | Intelligence Community Directive 203 — US government standard for analytic standards including confidence language | | **Flash Report** | Urgent, time-sensitive intelligence notification for imminent threats; prioritizes speed over depth | | **Intelligence Gap** | Area where collection is insufficient to answer a PIR; should be explicitly documented in reports | ## Tools & Systems - **ThreatConnect Reports**: Built-in report templates with ATT&CK mapping, IOC tables, and stakeholder distribution controls - **Recorded Future**: Pre-built intelligence report templates with automated sourcing from proprietary datasets - **OpenCTI Reports**: STIX-based report objects with linked entities for structured finished intelligence - **Microsoft Word/Confluence**: Common report delivery formats; use organization-approved templates with TLP headers ## Common Pitfalls - **Writing for analysts instead of the audience**: Technical detail appropriate for SOC analysts overwhelms executives. Maintain strict audience segmentation. - **Omitting confidence levels**: Statements presented without confidence qualifiers appear as established facts when they may be low-confidence assessments. - **Intelligence without recommendations**: Reports that describe threats without prescribing actions leave stakeholders without direction. - **Stale intelligence**: Publishing a report on a threat campaign that was resolved 2 weeks ago creates alarm without utility. Include freshness dating on all claims. - **Over-classification**: Applying TLP:RED to information that could be TLP:GREEN impedes community sharing and limits defensive value across the sector.
Related Skills
tracking-threat-actor-infrastructure
Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a
profiling-threat-actor-groups
Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.
performing-threat-modeling-with-owasp-threat-dragon
Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review.
performing-threat-landscape-assessment-for-sector
Conduct a sector-specific threat landscape assessment by analyzing threat actor targeting patterns, common attack vectors, and industry-specific vulnerabilities to inform organizational risk management.
performing-threat-intelligence-sharing-with-misp
Use PyMISP to create, enrich, and share threat intelligence events on a MISP platform, including IOC management, feed integration, STIX export, and community sharing workflows.
performing-threat-hunting-with-yara-rules
Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.
performing-threat-hunting-with-elastic-siem
Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
performing-threat-emulation-with-atomic-red-team
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
performing-open-source-intelligence-gathering
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s
performing-insider-threat-investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.
performing-dark-web-monitoring-for-threats
Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
managing-intelligence-lifecycle
Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.