threat-intelligence-enrichment

Threat Intelligence Enrichment

Workflow

Use search and extract to enrich security entities with authoritative and recent evidence; use map or crawl for known vendor portals or advisory collections. Keep this skill focused on query construction, source priority, verification, and security synthesis; execution mechanics should come from companion endpoint skills.

Treat the guidance below as base guidance; adapt it to the user's request when appropriate.

• Identify the input type: CVE, IOC, malware/tool, threat actor, vendor/product, advisory URL, incident, or campaign.
• Break the task into short subqueries under 400 characters: identifier, affected product, exploit status, vendor advisory, patches, mitigations, exploitation in the wild, and recent reporting.
• Search first, using exact-match style queries for CVEs, hashes, domains, IPs, advisory IDs, and malware names.
• Filter sources before extraction. Prioritize NVD/CVE records, vendor advisories, CISA/agency alerts, security research blogs, reputable incident reports, and official patch notes.
• Extract selected pages that can support exploit status, impact, affected versions, mitigations, timeline, or confidence.
• Use site navigation for vendor advisory portals or documentation sites when the relevant page is hard to find.
• Collect scoped advisory, changelog, release note, or documentation sections only when the user needs broad coverage.

Research Budget

• Start with a small focused search set covering the identifier, vendor advisory, exploit status, and mitigation or patch evidence.
• Extract only the strongest authoritative sources before drafting.
• Add more searches only for named gaps, such as missing affected versions, missing patch notes, or unclear exploitation status.
• Do not use map unless a known vendor portal or documentation site has a specific advisory or release note to locate.
• Do not use crawl unless the user asks for coverage across many related advisories or docs pages.

Capability Guidance

• Use search for CVEs, IOCs, advisories, exploit status, affected versions, mitigations, and recent incident reporting.
• Use extract on selected vendor advisories, CVE records, agency alerts, patch notes, and security research pages.
• Use map when a vendor portal or documentation site is known but the specific advisory is hard to locate.
• Use crawl for advisory/doc sets only when the user asks for coverage across many related pages.
• Use research only for threat landscape reports or multi-campaign summaries.

Query And Source Guidance

• Use exact identifiers in queries: CVE IDs, advisory IDs, product/version names, hashes, domains, IPs, malware names, and actor aliases.
• Prioritize vendor advisories, NVD/CVE records, CISA or national agency alerts, CERT/CC, official patch notes, and reputable security research.
• Treat social posts, exploit-db style references, and secondary news as supporting evidence unless confirmed by authoritative sources.
• Separate "exploited in the wild", "public PoC", "theoretical exploitability", and "patched" as different statuses.
• Report failed or inaccessible sources when they affect vendor advisories, CVE records, affected-version evidence, or mitigation guidance.

Output Template

Use this markdown structure and label uncertainty:

# Threat Intelligence Brief: <entity>

## Summary
- Current status:
- Confidence:
- Most important source:

## Entity Details
- Type:
- Aliases/identifiers:
- Related products or systems:

## Impact And Exposure
- Affected products/versions:
- Exploit status:
- Evidence quality:

## Mitigation And Detection
- Patches or mitigations:
- Detection or hunting notes:
- Recommended checks:

## Timeline
- <date>: <event> ([source](URL))

## Sources And Gaps
- Sources:
- Gaps or unresolved claims:

Do not overstate attribution, exploitation, or compromise evidence. Label speculation and unverified claims.