Mission Domains

🏴 Nation State

Mission domain · code ns

Catalog sources

9 no-auth

Disciplines

mapped

Data points

covered

Skills

run →

automation

🔧 Workbench 📈 Native dashboard All sources → AI Skills Playbooks Copilot brief Report

Intelligence Disciplines

ACTORINT (6) GOVINT (2) CYBINT (2) MALINT (2) NEWSINT (1) OSINT (1) REFINT (1)

Data Points

malware_family (5) event (4) hash (2) person (2) company (2) location (2) keyword (1)

Sources for this domain (9)

Name	Category	Auth	Format
CFR Cyber Operations Tracker State-sponsored cyber incident tracker (public dataset).	Nation State	NONE	`json`	home↗ api↗
ETDA Threat Group Cards APT group encyclopedia with tools and campaigns.	Nation State	NONE	`json`	home↗ api↗
EuRepoC Cyber Conflicts European Repository of Cyber Incidents — attributed state operations.	Nation State	NONE	`json`	home↗
GDELT / Media Cloud Global news event & tone monitoring (cross-cutting).	NEWSINT	NONE	`json`	home↗ api↗
MISP Galaxy Threat Actors Curated threat-actor cluster galaxy.	APT	NONE	`json`	home↗ api↗
MITRE ATT&CK Groups (STIX) Adversary groups, software and techniques.	APT	NONE	`json`	home↗ api↗
MITRE ATT&CK Software/Actors Adversary tooling & group knowledge base.	ACTORINT	NONE	`json`	home↗ api↗
Wikidata Query Service Structured open-knowledge graph (cross-cutting).	OSINT	NONE	`json`	home↗ api↗
Wikipedia / DBpedia Reference knowledge base (cross-cutting).	REFINT	NONE	`json`	home↗ api↗

🔍 Lookup

📊 Pre-built Queries · Nation State

Sources in this domain No-auth feeds only High-severity indicators Recent additions Sanctioned entities Open cases

🔄 Live Datasets & APIs (8 key-free · ingestible)

Dataset / API	Format	Endpoint
CFR Cyber Operations Tracker	`json`	https://raw.githubusercontent.com/council-on-foreign-relatio	collect
ETDA Threat Group Cards	`json`	https://apt.etda.or.th/cgi-bin/aptgroups.cgi?d=1	collect
GDELT / Media Cloud	`json`	https://api.gdeltproject.org/api/v2/doc/doc	collect
MISP Galaxy Threat Actors	`json`	https://raw.githubusercontent.com/MISP/misp-galaxy/main/clus	collect
MITRE ATT&CK Groups (STIX)	`json`	https://raw.githubusercontent.com/mitre/cti/master/enterpris	collect
MITRE ATT&CK Software/Actors	`json`	https://raw.githubusercontent.com/mitre/cti/master/enterpris	collect
Wikidata Query Service	`json`	https://query.wikidata.org/sparql	collect
Wikipedia / DBpedia	`json`	https://dbpedia.org/sparql	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — Nation State operations

Direction — frame the requirement for Nation State: what decision does this support, by when?
Collection — collect from the 9 mapped domain sources and enabled feeds; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🔗 Pivots

Sources →Country risk →Threat feed →Cases →Campaigns →

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Integrations →

🔄 Data Feeds & Datasets

Feed	Category	Format	Status
EuRepoC Cyber Incidents	Nation State	`json`	off
CFR Cyber Operations Tracker	Nation State	`json`	off

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook