Cyber Intelligence (CYBINT): Intelligence Discipline Guide

Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you have a decision.

What Cyber Intelligence is as a discipline

Cyber intelligence is the collection and analysis of adversary activity as it manifests in networks, hosts and applications. It draws on internal telemetry such as endpoint process trees, authentication logs, DNS and proxy records, netflow and email gateway data, and fuses that with external context from indicator feeds, technique catalogues, sandbox output and vendor research. The practice maps observed behaviour to known tradecraft, assesses what an intrusion was attempting to achieve, and produces judgements that drive hunting, detection engineering and response rather than raw indicator lists.

It operates across three tiers. Tactical work produces indicators and detections with short shelf life. Operational work tracks campaigns, infrastructure, tooling and targeting. Strategic work assesses adversary intent, capability trajectory and business risk. Sub-methods include hypothesis-driven threat hunting, detection engineering measured against technique coverage, structured intrusion analysis using kill chain and diamond models, and post-incident tradecraft extraction. It is the integration layer where the other technical disciplines converge into one picture.

Why it matters

Cyber intelligence answers whether activity is part of something larger and what comes next. A single alert carries no priority; the same alert attributed to a known intrusion set with a documented playbook has an obvious one. It tells you which of hundreds of techniques to detect first, based on who actually targets your sector rather than on a generic checklist, and it converts each incident into durable detection coverage instead of a closed ticket.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Process ancestry and command lines showing living-off-the-land execution: scripting hosts and signed system binaries invoked with unusual parameters
Authentication anomalies such as impossible travel, service accounts logging in interactively, and ticket requests inconsistent with normal patterns
Beaconing characteristics in netflow and proxy logs: interval regularity, jitter, byte-count symmetry and long-lived low-volume sessions
Persistence artefacts including scheduled tasks, run keys, WMI event subscriptions, service installations and cloud OAuth application grants
Lateral movement traces: remote service creation, writes to administrative SMB shares, and WinRM or RDP chains between unrelated hosts
Staging and egress patterns such as archive creation in temporary paths, transfers to cloud storage, and DNS volumes inconsistent with baseline
Technique-to-actor mappings that place observed behaviour inside a documented intrusion set and predict the likely next stage
Infrastructure overlaps linking your incident to externally reported campaigns through shared hosts, certificates, tooling or delivery patterns

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

MITRE ATT&CK — Technique taxonomy, procedure examples and group mappings used for coverage assessment and consistent reporting
Sigma rule repository — Vendor-neutral detection logic convertible to your SIEM query language, with community-maintained coverage
abuse.ch feeds — ThreatFox, URLhaus and Feodo Tracker supply free indicators for command and control, malware URLs and botnets
VirusTotal — File, URL and infrastructure reputation with relationship graphs between samples, domains and addresses
CISA advisories and KEV catalogue — Validated adversary tradecraft and confirmed exploited vulnerabilities drawn from real incident response
MISP — Open-source platform for structured indicator and event sharing with sector peers under handling markings
Public sandbox reports — Hybrid Analysis and ANY.RUN public tasks give observed behaviour, dropped files and network callbacks
Vendor intrusion research — Mandiant, Talos and ESET publications provide campaign narratives with stated attribution reasoning

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Set requirements — Derive collection priorities from the business: which crown jewels matter, which adversaries plausibly target your sector, which decisions the intelligence must support.
Instrument for the question — Confirm the telemetry needed to answer those requirements exists, is retained long enough and is queryable. Close the gaps before hunting.
Hunt on hypotheses — State a specific adversary behaviour, express it as a query over your telemetry, execute it, and record the outcome whether or not it hits.
Analyse intrusions structurally — Reconstruct each incident along the kill chain, populate a diamond model, and extract the techniques, tooling and infrastructure actually observed.
Convert to detection — Turn every confirmed technique into a tested detection with documented false-positive characteristics, and track coverage honestly rather than aspirationally.
Contextualise externally — Compare observations against public reporting and shared feeds to establish whether you are one victim within a broader campaign.
Report to the decision — Deliver assessments with explicit confidence language and a recommended action, not an indicator dump with no analytic judgement.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Domain Name — Human-readable address that maps to IP infrastructure via DNS.
IP Address — Internet Protocol address identifying a device or server on a network.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Malware Family — A named class of related malicious software.
Email Address — Electronic mail address tied to an individual or organization.
File Hash — Cryptographic fingerprint of a file, used for malware identification.
CVE / Vulnerability — Common Vulnerabilities and Exposures identifier for a known flaw.
SSL/TLS Certificate — A digital certificate binding a public key to an identity.
Person / Name — A named individual — the subject of identity resolution and profiling.
TLS / JA3 Fingerprint — A hash of TLS client-hello parameters used to fingerprint clients, malware, and C2 frameworks.

Related disciplines

Attack Surface Intelligence — Your Own Exposed Attack Surface
Breach Intelligence — Exposed Credentials and Compromised Data
Certificate Intelligence — TLS Certificates and Certificate Transparency
Dark Web Intelligence — Hidden Services and Closed Criminal Venues
Domain Intelligence — Domains, DNS, and Registration Intelligence
Malware Intelligence — Understanding Malicious Code

Inside the platform: where Cyber Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=CYBINT — Discipline hub
source-catalog.php?disc=CYBINT — Source catalogue filtered to this discipline
url-profile.php — Domain Name profile
ip-profile.php — IP Address profile
hash-profile.php — Malware Family profile
email-profile.php — Email Address profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Correlate Infrastructure
DNS Audit
Threat Hunt
Detection Rules
Enrichment Runner
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Set requirements is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Hunt on hypotheses turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report to the decision feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Cyber Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence practitioners run cyber intelligence over their own networks, mission systems and coalition enclaves as a defensive discipline. Authority derives from ownership of the network and from the mission mandate, and collection is of telemetry the organisation already generates: endpoint, authentication, network flow, proxy and mail data. The output supports cyber terrain understanding, hunt tasking, defensive course of action selection and commander decision points on system availability. It also feeds indications and warning where adversary reconnaissance precedes kinetic activity. Constraint: offensive response, including any form of hack-back, is not available to the analyst and is governed by a separate legal and command authority entirely; the defensive product stops at recommendation.

🕵 National intelligence

National services practise cyber intelligence as requirements-driven collection fused across compartments. The distinctive contribution is combining first-party network telemetry with sensitive collection and partner reporting to produce assessments that neither source could support alone. Analysts characterise adversary campaigns, assess intent and capability, and provide indications and warning to government and critical infrastructure. Classification handling is central, because the technical indicators are usually releasable while the collection that produced the context is not, so tearline writing is a core skill. Dissemination is deliberately structured so that industry and partners receive actionable defensive content quickly without exposure of sources or methods.

👮 Law enforcement

Investigators use cyber intelligence to reconstruct intrusions to an evidential standard. That means acquiring telemetry and images with continuity: recorded seizure, hashing at acquisition, working on copies, and documented tooling. Logs from third parties require production orders, and cross-border data requires mutual legal assistance or a recognised cooperation instrument, with preservation requests issued immediately because retention windows are short. Analysis must be reproducible by another examiner from the same evidence, which rules out conclusions that depend on a vendor black box. The output supports charging by establishing what was accessed, when, from where, and by which account, and by linking that activity to a controlling person.

🔍 Private investigation and corporate security

Corporate security teams practise this as the core of detection and response over their own estate, plus contracted work on client estates within a defined scope. The authority is ownership and employment policy, and the practical limits matter: monitoring staff activity engages privacy law and works councils in many jurisdictions, and evidence gathered without a lawful basis can be excluded from disciplinary proceedings. A private actor may not access adversary systems, retaliate, or probe third party infrastructure. Output feeds containment decisions, executive risk reporting, insurance notification and law enforcement referral, and increasingly regulatory notification on statutory clocks measured in hours.

📰 Journalism and OSINT media

Journalists use cyber intelligence material to report on intrusions, surveillance and critical infrastructure risk. Verification means having the underlying technical material examined by an independent expert rather than relying on a vendor or victim characterisation, and distinguishing clearly between what telemetry shows and what has been inferred. Source protection is acute here, because insiders providing logs or incident reports are readily identifiable from the material itself, so strip metadata and consider whether a detail is uniquely traceable. Coordinate publication timing with responders where live intrusions are involved, and give the affected organisation a right of reply.

🌍 NGO, humanitarian and human rights

Civil society organisations practise cyber intelligence defensively, often with limited telemetry and high-consequence targeting by state-aligned actors. Practice centres on device and account examination with the informed consent of the individual, since the person and not the organisation typically owns the device. Findings must be explained plainly, with support arranged before disclosure, because confirming a compromise is frightening and may indicate physical risk. Documentation is prepared to accountability standards for possible litigation or United Nations mechanisms. Duty of care extends to staff, who become targets once the work is known, and to partners in-country who face far greater consequences than the analyst does.

🎓 University and research

Researchers use cyber intelligence data to study detection efficacy, adversary behaviour distributions, alert triage economics and the reliability of attribution claims. Methodology must specify the telemetry source, its sampling and retention, and its inherent bias, since datasets from a single vendor or a single sector do not generalise. Reproducibility requires publishing detection logic and evaluation datasets, or synthetic equivalents where the real data cannot be shared. Ethics approval is required where telemetry contains identifiable user activity, and honeypot research needs an approved protocol covering the risk that captured infrastructure is used to harm third parties. Cite the dataset version and collection window explicitly.

Playbook: working Cyber Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Set intelligence requirements

Begin by writing down what decisions the capability must support and what questions it must answer, prioritised. Requirements come from leadership risk concerns, from the actual threat picture for the sector, and from known gaps. Without them, the function drifts into feed consumption and alert processing with no measure of relevance. A good output is a short, ranked requirements list with a named consumer for each item and a review date. Stop when every planned collection and every recurring product traces to a numbered requirement, and anything that does not is a candidate for removal.

Phase 2 — Map available telemetry

Inventory what visibility actually exists: endpoint detection coverage by platform, authentication and directory logging, DNS and proxy records, network flow, email gateway data, cloud control plane audit logs and application logs. Record retention for each and the proportion of the estate covered, because partial coverage is the normal state and unmeasured gaps become false clean results. Compare coverage against the technique profile of the threats in scope. A good output is a telemetry map with coverage percentage and retention per source, and a prioritised gap list. Stop when coverage is quantified rather than assumed.

Phase 3 — Establish the normal baseline

Characterise what routine activity looks like on this estate before trying to spot deviation: which administrative tools are legitimately used, which service accounts authenticate where and when, what the normal outbound destination profile is, which scripting and remote access tools are sanctioned. Most detection failure is either alerting on normal administration or missing intrusion because it resembles it. A good output is documented baselines for the noisiest technique areas, owned by the teams that generate the activity. Stop when analysts can answer whether a given observed behaviour is normal here without asking an engineer.

Phase 4 — Ingest and normalise external context

Bring in external intelligence deliberately rather than by subscription volume: technique catalogues, malware family reporting, vulnerability exploitation status, and indicators tied to actors relevant to the sector. Normalise it against a common technique vocabulary and record provenance and confidence per item. Reject indicator feeds that arrive without context, since an indicator without a reason cannot be triaged when it fires. A good output is a curated intelligence store where every item has a source, a date, a confidence and a link to a requirement. Stop when new feeds stop changing detections rather than merely adding volume.

Phase 5 — Build behavioural detection

Write detections against adversary behaviour rather than against atomic indicators, because indicators expire and behaviour persists. Prioritise techniques the relevant actors actually use and that your telemetry can see. Test each rule against historical data to measure false positive rate before release, and pair every detection with a written response action so the analyst receiving it knows what to do. A good output is a versioned detection set mapped to techniques with measured precision. Stop when high-priority techniques are covered by a tested detection, a hunt hypothesis or a documented visibility gap.

Phase 6 — Hunt on hypotheses

Run structured hunts against specific hypotheses derived from threat reporting, not open-ended data browsing. State the hypothesis, the data required, the query, the expected true positive appearance and the negative result meaning. Hunting has two legitimate outputs: finding activity, and proving a technique would be visible if present, which converts unknown coverage into known coverage. A good output is a hunt record with the queries, the scope, the period and the result, reusable as a detection or repeatable later. Stop a hunt when the hypothesis is resolved, not when the analyst runs out of ideas.

Phase 7 — Triage and enrich alerts

Process alerts with a consistent enrichment path so decisions are comparable: asset criticality and owner, account privilege, prevalence of the observed artefact across the estate, external reputation and known-good context. Prevalence is the highest-value enrichment and is routinely neglected, because something seen once on one host is a different problem from the same thing seen on eight hundred. A good output is a triage process with recorded dispositions and a measured rate of alerts closed without investigation. Stop refining when analyst decisions on the same alert are consistent between people.

Phase 8 — Investigate and scope

On confirmed activity, establish the full extent before acting: initial access, persistence mechanisms, credential access, lateral movement, the accounts and systems touched, and what was staged or exfiltrated. Scoping errors are the main cause of failed eradication, where containment removes one implant and the intruder returns through a second. Build a timeline anchored to log timestamps with the timezone recorded. A good output is a scoped incident with a defensible statement of extent and of what remains uncertain. Stop when the timeline accounts for the observed activity from first entry to last observation.

Phase 9 — Contain and eradicate on evidence

Sequence containment so it removes access rather than warning the intruder while leaving a route in. That normally means simultaneous action across identified persistence, credential rotation including service accounts and any secrets the compromised accounts could reach, and revocation of sessions and tokens. Preserve evidence before destructive remediation. A good output is a containment plan tied to the scoping findings with a defined sequence and a verification step. Stop when post-containment monitoring shows no further adversary activity across the full scope, not when the first indicator disappears.

Phase 10 — Produce intelligence, not just tickets

Convert the incident into reusable knowledge: techniques observed, detection gaps found, indicators with context, and an assessment of who this was and what they were after, with confidence stated. Feed it back into detections, into the actor knowledge base, and into sharing communities under an appropriate handling marking. An incident that closes without producing intelligence has been paid for twice. A good output is a written post-incident intelligence product plus specific detection and control changes. Stop when the changes are implemented and tested, not when the report is circulated.

Phase 11 — Measure and improve

Track outcome measures rather than volume: time to detect against time to containment, proportion of incidents detected internally rather than by an external party, technique coverage against the relevant threat profile, and the rate at which the same root cause recurs. Review closed incidents for what would have detected them earlier. Report gaps honestly, because a metric set designed to look good removes the reason the function exists. A good output is a quarterly capability review with specific improvements and their measured effect. Stop the cycle only when the requirements themselves are formally retired.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
MITRE ATT&CK	Open	Knowledge base of adversary tactics, techniques and procedures with detection and mitigation guidance and links to primary reporting.	Common vocabulary for mapping telemetry coverage, detection content and hunt hypotheses to real adversary behaviour.
Sigma	Open	Vendor-neutral detection rule format with a large community rule set covering log-based adversary behaviour.	Portable behavioural detection content that can be translated to whichever platform holds the telemetry.
MISP	Open	Open source platform for structured storage, correlation and controlled sharing of indicators, events and context.	Holds curated external intelligence with provenance and confidence, and supports sharing under handling markings.
abuse.ch projects	Open	Open datasets covering malware samples, command and control infrastructure, malicious URLs and botnet tracking.	Supplies contextualised indicators tied to malware families rather than bare atomic values without provenance.
URLhaus	Open	Database of URLs used for malware distribution with hosting metadata, payload references and observation timestamps.	Enriches proxy and mail telemetry hits with known distribution infrastructure and associated payload families.
Feodo Tracker	Open	Tracking of botnet command and control servers for prominent banking trojan and loader families.	Provides current command infrastructure for detection of loader activity that commonly precedes ransomware.
VirusTotal	Registration	Multi-engine file and URL analysis with behavioural reports, relationships and submission metadata.	Rapid enrichment and prevalence assessment of artefacts recovered from endpoints during triage.
GreyNoise	Registration	Classification of internet background scanning and exploitation traffic distinguishing mass activity from targeted behaviour.	Suppresses opportunistic internet noise in perimeter alerting so targeted activity is not buried.
CISA advisories and alerts	Open	Government advisories describing active threat activity, techniques, indicators and prescribed mitigations for defenders.	Authoritative, releasable basis for detection changes and for briefing leadership on active campaigns.
NCSC United Kingdom	Open	National technical authority publishing threat reporting, mitigation guidance and incident management advice.	Sector-relevant advisories and the incident reporting route for United Kingdom organisations.
CISA Known Exploited Vulnerabilities catalog	Open	Authoritative list of vulnerabilities confirmed exploited in the wild with remediation deadlines.	Focuses hunting and detection effort on the exploitation paths actually being used against defenders.
Shadowserver	Registration	Non-profit scanning and sinkhole operation delivering free daily compromise and exposure reports to network owners.	External detection channel that frequently identifies compromised hosts before internal telemetry does.
Malpedia	Registration	Curated malware family reference resolving naming synonyms with links to authoritative technical analysis.	Establishes which family an observed artefact belongs to and what behaviour to expect next.
FIRST	Open	Global forum of incident response teams publishing the Traffic Light Protocol, scoring systems and response practice guidance.	Governs handling markings on shared intelligence and provides the community route for cross-organisation coordination.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Cyber Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Endpoint detection and response platforms — Provide process, file and network telemetry with response actions on the host. Limitation: coverage gaps on servers, appliances and unmanaged devices are where intrusions live.
SIEM and log analytics platforms — Centralise and correlate telemetry for detection and investigation. Limitation: cost pressure drives retention down below the lookback most investigations require.
Sigma with backend converters — Author detection logic once and deploy across different platforms. Limitation: conversion loses fidelity, so rules must be validated where they will actually run.
Zeek and network metadata sensors — Produce rich protocol-level records independent of endpoint coverage. Limitation: encrypted traffic reduces visibility to metadata and connection patterns.
Velociraptor and endpoint hunting frameworks — Run targeted forensic collection across many hosts during scoping. Limitation: requires agent deployment and can be heavy on constrained systems.
Timeline and forensic analysis suites — Build defensible timelines from disk, memory and log artefacts. Limitation: labour intensive and dependent on artefact retention and timezone discipline.
MISP and threat intelligence platforms — Curate external context with provenance and drive automated enrichment. Limitation: unfiltered feed ingestion produces noise that degrades triage rather than helping it.
Sandbox analysis services — Determine behaviour and configuration of recovered samples quickly. Limitation: evasive samples withhold behaviour, and submission can alert the adversary.
Attack simulation and validation tooling — Test whether detections actually fire against the techniques they claim to cover. Limitation: simulated behaviour differs from real intrusions in ways that flatter coverage.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
DNS Audit — Bulk-resolves A/AAAA/MX/NS/TXT/CNAME/SOA records and stores them as observations, building passive DNS from your own collection.
Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Detection Rules — Generates YARA, Sigma and Snort/Suricata logic from the selected indicators, ready to deploy.
Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Detect behaviour, not indicators. Hashes and addresses expire within days, but the sequence of discovery commands, the persistence mechanism and the credential access method persist across campaigns because changing them costs the adversary real effort.
Prevalence is the most underused enrichment available. An artefact seen once on one host is a different problem from the same artefact on eight hundred, and the ratio answers the triage question faster than any reputation lookup.
Measure coverage before claiming a clean result. A hunt that found nothing across telemetry covering sixty percent of endpoints has established very little, and reporting it as clean is a false assurance you will pay for later.
Sequence containment as a single coordinated action. Removing one implant while a second persistence mechanism and a valid session remain simply informs the intruder that they have been seen and accelerates their objectives.
Rotate everything the compromised account could reach, not the account itself. Service account credentials, API keys, certificates and secrets accessible from the compromised context are the standard route back in after a superficial eradication.
Write the response action into the detection. A rule that fires without telling the analyst what it means and what to do next generates a decision problem at three in the morning, which is how real detections get suppressed.
Log timestamps and timezones are a recurring source of wrong conclusions. Normalise to a single reference at ingest and record the source timezone, because a timeline built from mixed offsets produces a false sequence of events.
An incident that closes without producing detection changes and reusable intelligence has been paid for twice. The post-incident product is not administrative overhead, it is the only mechanism that stops the same root cause recurring.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Cyber Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of incidents detected by internal telemetry rather than reported by an external party such as a partner, a customer or law enforcement.
Median time from earliest adversary activity in the timeline to detection, and separately from detection to full containment.
Technique coverage against the profile of actors assessed relevant to the sector, expressed as detection, hunt or documented gap rather than as a raw count.
Rate of alerts closed without investigation, which indicates detection precision and whether analysts trust the content.
Recurrence rate of the same root cause across incidents, which measures whether post-incident changes are actually implemented.
Proportion of hunts that produced either a finding or a documented coverage statement, rather than an inconclusive result.
Percentage of detections validated against historical data or simulation before release, and the proportion later found not to fire in production.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Confusing indicator collection with intelligence; a feed of hashes answers no question and expires within days of publication
Attribution creep, where a name assigned on thin infrastructure overlap then silently drives response and disclosure decisions
Detections written against a specific binary rather than the behaviour, defeated by a recompile or a renamed executable
Coverage theatre, counting techniques as detected when the rule has never been validated against real adversary execution
Discarding negative hunt results, so the same hypothesis is re-tested indefinitely and gaps are never demonstrably closed
Omitting confidence language, so a cautious analytic judgement is read by leadership as established fact

Legal and ethical considerations

Monitoring your own networks is lawful with appropriate notice, but employee telemetry is personal data: collection must be proportionate, disclosed in policy and retained only as long as necessary. Interception rules differ sharply between content and metadata by jurisdiction. Never probe, access or disrupt adversary infrastructure, since hack-back is unlawful in most regimes regardless of provocation. Preserve evidence with hashes and chain of custody where prosecution or insurance claims are plausible. Indicators shared with peers must be stripped of customer identifiers and respect handling markings.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Cyber Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is hack-back ever an option?

No. Accessing a system you do not own without authorisation is a criminal offence in essentially every relevant jurisdiction regardless of provocation, and the fact that the system attacked you is not a defence. It also routinely harms third parties, since adversary infrastructure is usually a compromised innocent host. Practically, it destroys evidence, escalates against an adversary with far less to lose, and creates uninsurable liability. The lawful options are containment and eradication on your own estate, notification and takedown requests to registrars and hosting providers, national CERT engagement, and referral to law enforcement, who can act under authority you do not have.

How much external intelligence should we consume?

Far less than most programmes do, and much more selectively. Indicator feeds without context cannot be triaged when they fire, and volume creates the illusion of coverage while consuming the analyst time that detection engineering needs. Select sources that map to your actual requirements and sector, insist on provenance and confidence per item, and measure whether each source has ever changed a detection or a decision. Retire sources that have not. The valuable external inputs are usually technique-level reporting, exploitation status for vulnerabilities you have, and sector-specific advisories, not bulk atomic indicators.

What log retention do we actually need?

Long enough to answer the question the next investigation will ask, which in practice means authentication and identity logs for at least a year, endpoint process telemetry for at least six months, and network metadata for as long as budget allows. The common failure is discovering an intrusion that began nine months ago with ninety days of logs, at which point the extent cannot be established and the organisation must assume the worst. Tier the retention rather than treating all sources equally: identity and endpoint telemetry are worth far more per byte than verbose application logs.

When should law enforcement be involved?

Earlier than most organisations do it, and the decision belongs with legal and executive leadership rather than the analyst. Involving them early preserves options: preservation requests to third parties can be issued while logs still exist, and cross-border requests take months. It does not mean surrendering control of the response. In many sectors it is now a regulatory expectation, and some incidents carry a statutory reporting duty on a short clock. Establish the contact route and the internal decision threshold before an incident, because negotiating it during one wastes the window when preservation still matters.

How do we handle monitoring staff activity lawfully?

Establish the lawful basis before deploying the capability, not after. In many jurisdictions employee monitoring requires a documented necessity and proportionality assessment, transparency to staff, and in some cases consultation with a works council or union. Scope monitoring to security purposes, restrict who can query personal activity, log the queries, and separate security detection from performance management entirely. Evidence gathered outside the declared basis may be inadmissible in disciplinary or legal proceedings, so the compliance work is not bureaucratic overhead, it is what makes the findings usable when you need them.

Should we share indicators with other organisations?

Yes, within a handling framework. Sharing is one of the few asymmetries defenders have, and sector sharing communities materially shorten detection time for everyone. Use the Traffic Light Protocol consistently, share behavioural detail and context rather than bare indicators, and check what your sharing reveals about your own environment before sending it. Have legal sign off the framework once rather than approving each exchange. The main practical barrier is not law but the fear of reputational exposure, which is best handled by sharing through a community with established norms and, where needed, anonymised submission.

How do we know our detection coverage is real?

Test it. Map detections to techniques, then validate each one either against historical data containing the behaviour or through controlled simulation on a representative host, and record which fired, which did not and why. Coverage claimed from a rule existing is routinely wrong, because rules break silently when log sources change, agents fail or field names shift. Re-test on a schedule and after every significant platform change. Report coverage in three states, detected, hunted or gap, rather than as a percentage, since a single number hides exactly the distinctions that matter.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

MITRE ATT&CK, which governs the shared vocabulary for describing adversary behaviour and mapping detection coverage.
ISO/IEC 27035 on information security incident management, which governs the incident process from detection through lessons learned.
NIST SP 800-61 computer security incident handling guidance, which governs response phases, roles and evidence handling.
ISO/IEC 27037 on identification, collection and preservation of digital evidence, which governs acquisition where prosecution is possible.
Traffic Light Protocol 2.0 published by FIRST, which governs handling and onward sharing of intelligence between organisations.
STIX 2.1 and TAXII 2.1 from OASIS, which govern structured representation and automated exchange of cyber threat intelligence.
The UK Computer Misuse Act 1990 and equivalent computer misuse legislation, which govern why active response against third party systems is unlawful.
The EU NIS2 Directive and sector regulations, which govern incident reporting duties and timelines for in-scope entities.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

ATT&CK knowledge base — MITRE. Adversary technique reference used for detection mapping and coverage assessment
Sigma detection rule project — SigmaHQ. Vendor-neutral detection rule format and community rule set
MISP threat intelligence platform — MISP Project. Open platform for curated storage and controlled sharing of intelligence
Traffic Light Protocol 2.0 — FIRST. Handling markings governing onward sharing of threat intelligence
Cybersecurity advisories and alerts — Cybersecurity and Infrastructure Security Agency. Authoritative advisories on active threat activity and mitigations
Incident management guidance — UK National Cyber Security Centre. National guidance on detection, response and reporting for organisations
Computer security incident handling guide — National Institute of Standards and Technology. Standard reference for incident response process and evidence handling
Open threat data projects — abuse.ch. Malware, command and control and distribution datasets used for enrichment
Daily compromise reporting — Shadowserver Foundation. Free external notification of compromised and exposed assets

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: fuses your telemetry with external reporting into technique-mapped assessments and tested detections. Explore the platform, or browse the rest of the library by following any tag above.