Mission Domains

🎯 APT / Espionage

Mission domain · code apt

Catalog sources

9 no-auth

Disciplines

mapped

Data points

covered

Skills

run →

automation

🔧 Workbench 📈 Native dashboard All sources → AI Skills Playbooks Copilot brief Report

Intelligence Disciplines

MALINT (6) ACTORINT (6) CERTINT (1) CYBINT (1) OSINT (1) REFINT (1)

Data Points

hash (6) malware_family (5) domain (2) person (2) company (2) location (2) ja3 (1) certificate (1) event (1) yara_rule (1)

Sources for this domain (10)

Name	Category	Auth	Format
abuse.ch SSLBL JA3 Fingerprints Malicious TLS client JA3 fingerprint blocklist.	CERTINT	NONE	`csv`	home↗ api↗
APTnotes Public archive of APT research reports.	APT	NONE	`json`	home↗ api↗
ETDA Threat Group Cards APT group encyclopedia with tools and campaigns.	Nation State	NONE	`json`	home↗ api↗
MISP Galaxy Threat Actors Curated threat-actor cluster galaxy.	APT	NONE	`json`	home↗ api↗
MITRE ATT&CK Groups (STIX) Adversary groups, software and techniques.	APT	NONE	`json`	home↗ api↗
MITRE ATT&CK Software/Actors Adversary tooling & group knowledge base.	ACTORINT	NONE	`json`	home↗ api↗
ORKL Threat Report Library Full-text CTI report library API.	APT	NONE	`json`	home↗ api↗
Wikidata Query Service Structured open-knowledge graph (cross-cutting).	OSINT	NONE	`json`	home↗ api↗
Wikipedia / DBpedia Reference knowledge base (cross-cutting).	REFINT	NONE	`json`	home↗ api↗
Malpedia Curated malware family encyclopedia.	MALINT	KEY	`json`	home↗ api↗

🔍 Lookup

📊 Pre-built Queries · APT / Espionage

Sources in this domain No-auth feeds only High-severity indicators Recent additions Sanctioned entities Open cases

🔄 Live Datasets & APIs (9 key-free · ingestible)

Dataset / API	Format	Endpoint
abuse.ch SSLBL JA3 Fingerprints	`csv`	https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv	collect
APTnotes	`json`	https://raw.githubusercontent.com/aptnotes/data/master/APTno	collect
ETDA Threat Group Cards	`json`	https://apt.etda.or.th/cgi-bin/aptgroups.cgi?d=1	collect
MISP Galaxy Threat Actors	`json`	https://raw.githubusercontent.com/MISP/misp-galaxy/main/clus	collect
MITRE ATT&CK Groups (STIX)	`json`	https://raw.githubusercontent.com/mitre/cti/master/enterpris	collect
MITRE ATT&CK Software/Actors	`json`	https://raw.githubusercontent.com/mitre/cti/master/enterpris	collect
ORKL Threat Report Library	`json`	https://orkl.eu/api/v1/library/entries	collect
Wikidata Query Service	`json`	https://query.wikidata.org/sparql	collect
Wikipedia / DBpedia	`json`	https://dbpedia.org/sparql	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — APT / Espionage operations

Direction — frame the requirement for APT / Espionage: what decision does this support, by when?
Collection — collect from the 10 mapped domain sources and enabled feeds; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🔗 Pivots

Sources →Country risk →Threat feed →Cases →Campaigns →

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Integrations →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook