Mission Domains

⚠️ Threat Analysis

Mission domain · code threat

Catalog sources

6 no-auth

Disciplines

mapped

Data points

covered

Skills

run →

automation

🔧 Workbench 📈 Native dashboard All sources → AI Skills Playbooks Copilot brief Report

Intelligence Disciplines

CYBINT (4) MALINT (3) ACTORINT (3) GOVINT (1)

Data Points

domain (5) ip (4) hash (3) malware_family (1) cve (1) yara_rule (1) file (1)

Sources for this domain (7)

Name	Category	Auth	Format
abuse.ch ThreatFox Family-labelled IoC exchange.	Threat Analysis	NONE	`json`	home↗ api↗
CISA Automated Indicator Sharing US-CERT indicator sharing / advisories.	Threat Analysis	NONE	`xml`	home↗
MITRE ATT&CK Software/Actors Adversary tooling & group knowledge base.	ACTORINT	NONE	`json`	home↗ api↗
ORKL Threat Report Library Full-text CTI report library API.	APT	NONE	`json`	home↗ api↗
SANS Internet Storm Center Internet threat telemetry & handler diary.	CYBINT	NONE	`json`	home↗ api↗
YARA / Sigma / Detection Rules Open detection-signature repositories.	MALINT	NONE	`text`	home↗ api↗
AlienVault OTX Pulses Community threat-intel pulses (free key).	Threat Analysis	KEY	`json`	home↗ api↗

🔍 Lookup

📊 Pre-built Queries · Threat Analysis

Sources in this domain No-auth feeds only High-severity indicators Recent additions Sanctioned entities Open cases

🔄 Live Datasets & APIs (5 key-free · ingestible)

Dataset / API	Format	Endpoint
abuse.ch ThreatFox	`json`	https://threatfox.abuse.ch/export/json/recent/	collect
MITRE ATT&CK Software/Actors	`json`	https://raw.githubusercontent.com/mitre/cti/master/enterpris	collect
ORKL Threat Report Library	`json`	https://orkl.eu/api/v1/library/entries	collect
SANS Internet Storm Center	`json`	https://isc.sans.edu/api/	collect
YARA / Sigma / Detection Rules	`text`	https://raw.githubusercontent.com/Neo23x0/signature-base/mas	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — Threat Analysis operations

Direction — frame the requirement for Threat Analysis: what decision does this support, by when?
Collection — collect from the 7 mapped domain sources and enabled feeds; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🔗 Pivots

Sources →Country risk →Threat feed →Cases →Campaigns →

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Integrations →

🔄 Data Feeds & Datasets

Feed	Category	Format	Status
abuse.ch ThreatFox	Catalog: Threat Analysis	`json`	off

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook