{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.tr.cyber-threat-intelligence","code":"thing-q25053549","url":"https://ver.cy/models/thing/q25053549/","name":"cyber threat intelligence","alternateNames":[],"kind":"thing","status":"published","version":"0.1.0-research.1","language":"en","classifiers":{"family":"Thing Registry","category":"Activities and processes","entryKind":"thing","plane":"ACT","domain":["ACT.ACT"],"industry":[],"navPath":"","tags":[],"facets":{}},"whatItIs":"Cyber threat intelligence is information about cyber threats that has been evaluated and analysed in context to support decisions about preventing, detecting, responding to, or managing those threats, with the term also used for the activity that produces it.","purpose":"Enable an agent to recognise cyber threat intelligence, assess its evidential strength and relevance, and determine how it may inform authorised defensive decisions.","scope":{"in":["Intelligence requirements tied to exposed assets, threat scenarios and named decision owners","Collection and evaluation of cyber threat reporting, telemetry and external intelligence","Analysis of adversary behaviour, capabilities, targeting and competing explanations","Intelligence assessments with confidence, applicability and temporal limits","Controlled dissemination, defensive recommendations and consumer feedback"],"out":["General vulnerability management and remediation execution","Security monitoring infrastructure and raw telemetry storage","Incident response case management and containment execution","Malware reverse engineering as a standalone technical investigation","Offensive cyber operations and access acquisition","Enterprise risk ownership and final acceptance of business risk"],"boundaries":[]},"distinguishingFeatures":["A proposed intelligence product can identify the threat-related decision or requirement it serves; a raw feed subscription alone does not demonstrate this.","An assessment separates observed cyber activity from analytical interpretation and exposes the evidence supporting its conclusions.","An indicator is accompanied by context, relevance and temporal limits before the model treats it as decision-ready intelligence.","A threat assessment explains adversary behaviour or plausible hostile activity; a vulnerability inventory alone describes weaknesses without establishing a threat.","An intelligence recommendation remains distinguishable from permission to execute blocking, containment or other operational changes."],"structure":{"bundles":[{"id":"intelligence-purpose-and-boundaries","name":"Intelligence Purpose and Boundaries","description":"Establishes what counts as cyber threat intelligence in the relevant setting and which decisions it serves.","layers":[{"id":"definition-and-instance","name":"Definition and Instance","description":"Records the adopted conception of intelligence and tests whether a candidate activity or output meets it.","findings":[{"id":"declared-intelligence-conception","name":"Declared Intelligence Conception","description":"Capture whose definition applies, its criteria and whether the instance is an analytical activity, service or assessment.","questions":[{"text":"Which organisation or analytical tradition supplies the working definition, and what makes an output intelligence under that definition?","id":"declared-intelligence-conception-q01","kind":"definition"},{"text":"What distinguishes this instance from raw threat data, a security alert or general cybersecurity advice?","id":"declared-intelligence-conception-q02","kind":"boundary"}]}]},{"id":"consumer-and-requirement","name":"Consumer and Requirement","description":"Connects intelligence work to an accountable consumer and a bounded decision.","findings":[{"id":"decision-linked-requirement","name":"Decision-Linked Requirement","description":"Record the intelligence question, protected interests, decision deadline and criteria for a useful answer.","questions":[{"text":"Which consumer must decide what, by when, and concerning which assets or business dependencies?","id":"decision-linked-requirement-q01","kind":"action"},{"text":"What observable deliverable would satisfy the requirement, and which related questions remain outside it?","id":"decision-linked-requirement-q02","kind":"boundary"}]}]}]},{"id":"collection-and-evidence-integrity","name":"Collection and Evidence Integrity","description":"Structures the acquisition, provenance and evaluation of evidence used in cyber threat assessments.","layers":[{"id":"collection-coverage","name":"Collection Coverage","description":"Relates collection sources and observable environments to the intelligence requirement.","findings":[{"id":"visibility-and-collection-gaps","name":"Visibility and Collection Gaps","description":"Record what telemetry and reporting can reveal, what they cannot reveal and which collection activities are authorised.","questions":[{"text":"Which systems, populations, locations and periods are visible through the available telemetry and reporting?","id":"visibility-and-collection-gaps-q01","kind":"measurement"},{"text":"Which authorised collection step could resolve the most decision-relevant gap?","id":"visibility-and-collection-gaps-q02","kind":"action"}]}]},{"id":"source-and-claim-evaluation","name":"Source and Claim Evaluation","description":"Separates source reliability, individual claim credibility and independence of supporting reports.","findings":[{"id":"traceable-independent-evidence","name":"Traceable Independent Evidence","description":"Preserve original observations, transformations and reporting dependencies so that repeated claims do not automatically count as corroboration.","questions":[{"text":"What original observation supports each material claim, and through which intermediaries or transformations did it arrive?","id":"traceable-independent-evidence-q01","kind":"provenance"},{"text":"Which supporting reports are independent, and what evidence bears on source reliability, claim credibility or possible deception?","id":"traceable-independent-evidence-q02","kind":"provenance"}]}]}]},{"id":"adversary-and-activity-analysis","name":"Adversary and Activity Analysis","description":"Organises observations of hostile cyber activity into bounded behavioural assessments and attribution hypotheses.","layers":[{"id":"behaviour-and-activity-patterns","name":"Behaviour and Activity Patterns","description":"Describes observed techniques, targeting and relationships among events without assuming a common actor.","findings":[{"id":"evidence-backed-activity-cluster","name":"Evidence-Backed Activity Cluster","description":"Record the evidence for grouping observations, their behavioural interpretation and alternative benign or unrelated explanations.","questions":[{"text":"Which observed behaviours and targeting patterns support the proposed cluster, and which relationships are inferred?","id":"evidence-backed-activity-cluster-q01","kind":"provenance"},{"text":"Could shared infrastructure, commodity tooling or legitimate administration explain the apparent connection?","id":"evidence-backed-activity-cluster-q02","kind":"boundary"}]}]},{"id":"identity-and-attribution","name":"Identity and Attribution","description":"Keeps technical clustering, actor naming and claims about operators or sponsors at their respective evidential levels.","findings":[{"id":"bounded-attribution-hypothesis","name":"Bounded Attribution Hypothesis","description":"Record attribution propositions, provider-specific aliases and the evidence needed to distinguish competing identity explanations.","questions":[{"text":"Does the attribution concern an activity cluster, an operator, an organisation or a sponsor, and what evidence supports that level?","id":"bounded-attribution-hypothesis-q01","kind":"boundary"},{"text":"Which provider assigned each actor name, and does a proposed alias mapping mean equivalence, overlap or an unresolved relationship?","id":"bounded-attribution-hypothesis-q02","kind":"provenance"},{"text":"What additional observation would strengthen or undermine the leading attribution hypothesis?","id":"bounded-attribution-hypothesis-q03","kind":"measurement"}]}]}]},{"id":"assessment-and-temporal-relevance","name":"Assessment and Temporal Relevance","description":"Turns analysis into explicit judgments whose uncertainty, consumer applicability and validity can be assessed.","layers":[{"id":"judgment-and-uncertainty","name":"Judgment and Uncertainty","description":"Records assessed propositions, assumptions, alternatives and the reasoning behind uncertainty statements.","findings":[{"id":"qualified-threat-judgment","name":"Qualified Threat Judgment","description":"Make each important judgment inspectable by separating observations, inferences, predictions and analytical confidence.","questions":[{"text":"What exact proposition is assessed, and which parts are observed, inferred or forecast?","id":"qualified-threat-judgment-q01","kind":"definition"},{"text":"What supports the confidence rating, and, if likelihood is stated, which event and time horizon does it describe?","id":"qualified-threat-judgment-q02","kind":"measurement"},{"text":"Which assumption or competing explanation could materially change the consumer's decision?","id":"qualified-threat-judgment-q03","kind":"boundary"}]}]},{"id":"applicability-and-decay","name":"Applicability and Decay","description":"Connects threat judgments and indicators to a particular environment and review period.","findings":[{"id":"consumer-specific-validity","name":"Consumer-Specific Validity","description":"Record environmental fit, observation dates and invalidation triggers, including infrastructure reassignment and changes in adversary behaviour.","questions":[{"text":"Which consumer exposures, technologies or targeting evidence make this assessment applicable?","id":"consumer-specific-validity-q01","kind":"provenance"},{"text":"When was the relevant activity observed, and what evidence or elapsed interval should trigger reassessment?","id":"consumer-specific-validity-q02","kind":"measurement"},{"text":"What verification is needed before a historical indicator is used for a current operational decision?","id":"consumer-specific-validity-q03","kind":"action"}]}]}]},{"id":"dissemination-and-defensive-use","name":"Dissemination and Defensive Use","description":"Governs how intelligence reaches consumers, informs defensive choices and changes in response to outcomes.","layers":[{"id":"product-and-sharing","name":"Product and Sharing","description":"Packages judgments and supporting context for an intended audience under explicit handling constraints.","findings":[{"id":"usable-permitted-intelligence-product","name":"Usable Permitted Intelligence Product","description":"Specify the audience, delivery form, sharing permissions and minimum context that must survive summarisation or automated exchange.","questions":[{"text":"Which audience may receive this product, and what source permissions, sharing markings or contractual terms constrain redistribution?","id":"usable-permitted-intelligence-product-q01","kind":"boundary"},{"text":"Which evidence links, confidence statements, timestamps and caveats must accompany the product in its intended delivery format?","id":"usable-permitted-intelligence-product-q02","kind":"action"}]}]},{"id":"decision-support-and-feedback","name":"Decision Support and Feedback","description":"Connects intelligence to proposed defensive actions and subsequent evidence of usefulness or error.","findings":[{"id":"authorised-use-and-revision","name":"Authorised Use and Revision","description":"Record proposed hunts, detection changes or prioritisation decisions, their approval requirements and feedback that warrants correction.","questions":[{"text":"Which defensive action does the assessment support, and what validation and authority are required before execution?","id":"authorised-use-and-revision-q01","kind":"action"},{"text":"What consumer outcome would demonstrate decision value, and what feedback would require correction, withdrawal or renewed collection?","id":"authorised-use-and-revision-q02","kind":"measurement"}]}]}]},{"id":"evidence-and-external-alignment","name":"Evidence and external alignment","description":"What the world already says about this thing, gathered so the model can be checked against it.","layers":[{"id":"reported-evidence","name":"Reported evidence","description":"Findings from the breadth pass, kept separate from the structural claims.","findings":[{"id":"evidence-confidence-notes","name":"Check these first","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these check these first hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-confidence-notes-q01","kind":"provenance"}]},{"id":"evidence-kinds","name":"Kinds and varieties","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these kinds and varieties hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-kinds-q01","kind":"provenance"}]},{"id":"evidence-identifiers","name":"Identifiers and schemes","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these identifiers and schemes hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-identifiers-q01","kind":"provenance"}]},{"id":"evidence-standards-and-regulation","name":"Standards and regulation","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these standards and regulation hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-standards-and-regulation-q01","kind":"provenance"}]},{"id":"evidence-real-world-use","name":"Real-world use","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these real-world use hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-real-world-use-q01","kind":"provenance"}]},{"id":"evidence-failure-modes-and-hazards","name":"Failure modes and hazards","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these failure modes and hazards hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-failure-modes-and-hazards-q01","kind":"provenance"}]},{"id":"evidence-regional-variation","name":"Regional variation","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these regional variation hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-regional-variation-q01","kind":"provenance"}]},{"id":"evidence-neighbours","name":"Neighbouring kinds and how to tell them apart","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these neighbouring kinds and how to tell them apart hold for the sense of cyber threat intelligence this model covers, and on what evidence?","id":"evidence-neighbours-q01","kind":"provenance"}]}]}]}]},"agentConduct":{"may":["Collect, analyse and share threat intelligence within the sharing rules the source sets.","Report indicators of compromise to the organization that authorized the work.","Explain threat intelligence concepts and frameworks."],"mustNot":["Share intelligence beyond the audience its source marked, such as under a traffic light protocol label.","Attribute an attack to a named person, group or state without solid evidence.","Use threat intelligence to attack, hack back or access systems without authorization.","Collect personal data on individuals beyond what the lawful purpose needs."],"requiresHuman":["Publicly attributing an attack.","Sharing intelligence with authorities or outside parties."]},"ethics":{"considerations":["Wrong attribution can damage reputations and escalate conflicts between states.","Intelligence work can drift into surveillance of innocent people."],"affectedParties":["Victims of attacks","Wrongly accused parties","Users of affected systems"]},"owners":{"steward":"The organization that produces or receives it; sharing communities set rules for each exchange.","roles":[],"masterSystems":[]},"relations":[{"target":"Q104845326","type":"parent","note":"registry parent class"},{"target":"Q7406919","type":"parent","note":"registry parent class"}],"interaction":{"identity":{"applicability":"required","items":["Vercy registry: vr.tr.cyber-threat-intelligence","Wikidata: Q25053549 (https://www.wikidata.org/wiki/Q25053549)"]},"properties":{"applicability":"not-applicable","items":["Intelligence requirement: Linked decision owner, intelligence question, protected assets and decision deadline","Intelligence orientation: Declared taxonomy, potentially strategic, operational, tactical or technical; multiple values allowed","Analytical confidence: Explicitly named confidence scale with rationale and assessment date","Assessed likelihood: Probability from 0 to 1 or a defined verbal scale, attached to a specified proposition and time horizon; unknown allowed","Evidence lineage: Links from claims to observations, original sources, intermediaries and transformations","Temporal applicability: Unassessed, current, review-due, superseded or expired, with observation and review dates","Consumer relevance: Links to consumer technologies, sectors, locations, business dependencies and observed exposure, with supporting rationale","Handling constraints: Source permissions, applicable sharing markings, audience restrictions and permitted uses"]},"recognition":{"applicability":"not-applicable","items":[]},"capabilities":{"applicability":"required","items":["Translate a defensive decision into prioritised intelligence requirements and collection gaps.","Trace and compare threat claims while identifying duplicated reporting and unsupported inference.","Develop competing explanations for cyber activity and identify evidence that would discriminate between them.","Assess the relevance and freshness of indicators, behavioural patterns and threat assessments for a consumer.","Prepare audience-appropriate intelligence products with uncertainty and handling constraints.","Propose authorised defensive follow-up and revise intelligence using consumer feedback and subsequent observations."]},"hazards":{"applicability":"required","items":["Outdated or poorly supported intelligence can trigger false alarms and misdirect defensive resources.","Incorrect attribution can cause unjustified accusations and harmful organisational decisions.","Sharing intelligence without appropriate controls can expose personal information or sensitive operational details.","Treating intelligence as complete coverage can leave relevant threats unrecognised."]},"interfaces":{"applicability":"required","items":["Structured Threat Information Expression (STIX), OASIS.","Traffic Light Protocol, Forum of Incident Response and Security Teams (FIRST)."]},"context":{"applicability":"required","items":["Cyber threat intelligence is used in security monitoring, incident response and organisational risk assessment.","It helps defenders interpret observed activity, prioritise investigations and select protective measures using evidence about relevant threats."]}},"sources":[{"title":"Wikidata item Q25053549: cyber threat intelligence","url":"https://www.wikidata.org/wiki/Q25053549","note":"identity and sense of the item"},{"title":"Wikipedia: Cyber threat intelligence","url":"https://en.wikipedia.org/wiki/Cyber_threat_intelligence","note":"general description of the item"}],"openQuestions":["Which authoritative and practitioner definitions should anchor this entry, and where do they disagree about when processed threat information becomes intelligence?","Does the ACT placement require intelligence products to be represented through a neighbouring information model, and does an existing world model already own this concept?","Which distinctions among strategic, operational, tactical and technical intelligence are sufficiently consistent to adopt, and which require provider-specific definitions?","Which confidence, likelihood and source-evaluation conventions permit meaningful comparison across providers without erasing differences in method?","What evidence supports practical review intervals and usefulness measures for indicators, behavioural assessments and strategic forecasts in different consumer environments?"],"resources":{"spec":"/models/things/publications/thing-q25053549/spec.json"},"provenance":{"origin":"thing registry research (pass 2)","builtFrom":["models/things/publications/thing-q25053549/spec.json"],"providers":["Codex"],"researchStatus":"unreviewed","generatedAt":"2026-09-12T08:57:33Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"not-applicable","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"filled","interaction.context":"filled","sources":"filled"},"notes":{"_gate":"Published through the thing publication gate 1.0 on 2026-10-07T10:10:29+00:00: completeness 1.00; sense: Wikidata description; 2 live sources; review by codex: pass","interaction.properties":"Plane ACT: no invented physical properties.","interaction.recognition":"Cyber threat intelligence is evaluated information whose identity and quality cannot be established through visual cues."},"score":1.0}}