🏴 Nation State theater

Tracks state-directed cyber operations, sabotage, and sanctioned infrastructure across rival nations. Central to strategic warning, critical-infrastructure defense, and policy response.

🏹 Threat Actors

🦠 Malware & Tools

🛡 Exploited Vulnerabilities

🧭 Intelligence disciplines

📚 Priority sources & datasets

📜 Nation State Playbook

1. Collect state-attributed indicators from CISA advisories, allied CERT bulletins, and vendor APT reporting.
2. Enrich each indicator with ASN, geolocation, and hosting data to map operator infrastructure.
3. Map observed TTPs to MITRE ATT&CK and cross-reference against known state-sponsored playbooks.
4. Attribute activity to a sponsoring state by clustering infrastructure, tooling, and targeting against OFAC and OpenSanctions designations.
5. Brief policy and SOC stakeholders with a confidence-rated assessment and geopolitical context.
6. Push high-confidence IOCs to blocklists and flag sanctioned infrastructure for legal and compliance action.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots

🔄 Data Feeds & Datasets