cyber threat intelligence
Enable an agent to recognise cyber threat intelligence, assess its evidential strength and relevance, and determine how it may inform authorised defensive decisions.
Bundle → Layer → Finding → Questions Filled
6 bundles · 11 layers · 18 findings · 31 questions
Intelligence Purpose and Boundaries Establishes what counts as cyber threat intelligence in the relevant setting and which decisions it serves.
Definition and Instance
Records the adopted conception of intelligence and tests whether a candidate activity or output meets it.
Declared Intelligence Conception
Capture whose definition applies, its criteria and whether the instance is an analytical activity, service or assessment.
- Which organisation or analytical tradition supplies the working definition, and what makes an output intelligence under that definition? definition
- What distinguishes this instance from raw threat data, a security alert or general cybersecurity advice? boundary
Consumer and Requirement
Connects intelligence work to an accountable consumer and a bounded decision.
Decision-Linked Requirement
Record the intelligence question, protected interests, decision deadline and criteria for a useful answer.
- Which consumer must decide what, by when, and concerning which assets or business dependencies? action
- What observable deliverable would satisfy the requirement, and which related questions remain outside it? boundary
Collection and Evidence Integrity Structures the acquisition, provenance and evaluation of evidence used in cyber threat assessments.
Collection Coverage
Relates collection sources and observable environments to the intelligence requirement.
Visibility and Collection Gaps
Record what telemetry and reporting can reveal, what they cannot reveal and which collection activities are authorised.
- Which systems, populations, locations and periods are visible through the available telemetry and reporting? measurement
- Which authorised collection step could resolve the most decision-relevant gap? action
Source and Claim Evaluation
Separates source reliability, individual claim credibility and independence of supporting reports.
Traceable Independent Evidence
Preserve original observations, transformations and reporting dependencies so that repeated claims do not automatically count as corroboration.
- What original observation supports each material claim, and through which intermediaries or transformations did it arrive? provenance
- Which supporting reports are independent, and what evidence bears on source reliability, claim credibility or possible deception? provenance
Adversary and Activity Analysis Organises observations of hostile cyber activity into bounded behavioural assessments and attribution hypotheses.
Behaviour and Activity Patterns
Describes observed techniques, targeting and relationships among events without assuming a common actor.
Evidence-Backed Activity Cluster
Record the evidence for grouping observations, their behavioural interpretation and alternative benign or unrelated explanations.
- Which observed behaviours and targeting patterns support the proposed cluster, and which relationships are inferred? provenance
- Could shared infrastructure, commodity tooling or legitimate administration explain the apparent connection? boundary
Identity and Attribution
Keeps technical clustering, actor naming and claims about operators or sponsors at their respective evidential levels.
Bounded Attribution Hypothesis
Record attribution propositions, provider-specific aliases and the evidence needed to distinguish competing identity explanations.
- Does the attribution concern an activity cluster, an operator, an organisation or a sponsor, and what evidence supports that level? boundary
- Which provider assigned each actor name, and does a proposed alias mapping mean equivalence, overlap or an unresolved relationship? provenance
- What additional observation would strengthen or undermine the leading attribution hypothesis? measurement
Assessment and Temporal Relevance Turns analysis into explicit judgments whose uncertainty, consumer applicability and validity can be assessed.
Judgment and Uncertainty
Records assessed propositions, assumptions, alternatives and the reasoning behind uncertainty statements.
Qualified Threat Judgment
Make each important judgment inspectable by separating observations, inferences, predictions and analytical confidence.
- What exact proposition is assessed, and which parts are observed, inferred or forecast? definition
- What supports the confidence rating, and, if likelihood is stated, which event and time horizon does it describe? measurement
- Which assumption or competing explanation could materially change the consumer's decision? boundary
Applicability and Decay
Connects threat judgments and indicators to a particular environment and review period.
Consumer-Specific Validity
Record environmental fit, observation dates and invalidation triggers, including infrastructure reassignment and changes in adversary behaviour.
- Which consumer exposures, technologies or targeting evidence make this assessment applicable? provenance
- When was the relevant activity observed, and what evidence or elapsed interval should trigger reassessment? measurement
- What verification is needed before a historical indicator is used for a current operational decision? action
Dissemination and Defensive Use Governs how intelligence reaches consumers, informs defensive choices and changes in response to outcomes.
Product and Sharing
Packages judgments and supporting context for an intended audience under explicit handling constraints.
Usable Permitted Intelligence Product
Specify the audience, delivery form, sharing permissions and minimum context that must survive summarisation or automated exchange.
- Which audience may receive this product, and what source permissions, sharing markings or contractual terms constrain redistribution? boundary
- Which evidence links, confidence statements, timestamps and caveats must accompany the product in its intended delivery format? action
Decision Support and Feedback
Connects intelligence to proposed defensive actions and subsequent evidence of usefulness or error.
Authorised Use and Revision
Record proposed hunts, detection changes or prioritisation decisions, their approval requirements and feedback that warrants correction.
- Which defensive action does the assessment support, and what validation and authority are required before execution? action
- What consumer outcome would demonstrate decision value, and what feedback would require correction, withdrawal or renewed collection? measurement
Evidence and external alignment What the world already says about this thing, gathered so the model can be checked against it.
Reported evidence
Findings from the breadth pass, kept separate from the structural claims.
Check these first
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these check these first hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Kinds and varieties
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these kinds and varieties hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Identifiers and schemes
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these identifiers and schemes hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Standards and regulation
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these standards and regulation hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Real-world use
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these real-world use hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Failure modes and hazards
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these failure modes and hazards hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Regional variation
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these regional variation hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Neighbouring kinds and how to tell them apart
Recalled without web access and unsourced; every item is a lead to verify.
- Which of these neighbouring kinds and how to tell them apart hold for the sense of cyber threat intelligence this model covers, and on what evidence? provenance
Classifiers Filled
- Family
- Thing Registry
- Category
- Activities and processes
- Entry kind
- thing
- Plane
- ACT
- Domain
- ACT.ACT
What it is Filled
Cyber threat intelligence is information about cyber threats that has been evaluated and analysed in context to support decisions about preventing, detecting, responding to, or managing those threats, with the term also used for the activity that produces it.
In scope
- Intelligence requirements tied to exposed assets, threat scenarios and named decision owners
- Collection and evaluation of cyber threat reporting, telemetry and external intelligence
- Analysis of adversary behaviour, capabilities, targeting and competing explanations
- Intelligence assessments with confidence, applicability and temporal limits
- Controlled dissemination, defensive recommendations and consumer feedback
Out of scope
- General vulnerability management and remediation execution
- Security monitoring infrastructure and raw telemetry storage
- Incident response case management and containment execution
- Malware reverse engineering as a standalone technical investigation
- Offensive cyber operations and access acquisition
- Enterprise risk ownership and final acceptance of business risk
Why it exists Filled
Enable an agent to recognise cyber threat intelligence, assess its evidential strength and relevance, and determine how it may inform authorised defensive decisions.
Distinguishing features Filled
- A proposed intelligence product can identify the threat-related decision or requirement it serves; a raw feed subscription alone does not demonstrate this.
- An assessment separates observed cyber activity from analytical interpretation and exposes the evidence supporting its conclusions.
- An indicator is accompanied by context, relevance and temporal limits before the model treats it as decision-ready intelligence.
- A threat assessment explains adversary behaviour or plausible hostile activity; a vulnerability inventory alone describes weaknesses without establishing a threat.
- An intelligence recommendation remains distinguishable from permission to execute blocking, containment or other operational changes.
What robots and AI may and may not do Filled
Must not
- Share intelligence beyond the audience its source marked, such as under a traffic light protocol label.
- Attribute an attack to a named person, group or state without solid evidence.
- Use threat intelligence to attack, hack back or access systems without authorization.
- Collect personal data on individuals beyond what the lawful purpose needs.
Only with a human decision
- Publicly attributing an attack.
- Sharing intelligence with authorities or outside parties.
May
- Collect, analyse and share threat intelligence within the sharing rules the source sets.
- Report indicators of compromise to the organization that authorized the work.
- Explain threat intelligence concepts and frameworks.
Moral aspects Filled
- Wrong attribution can damage reputations and escalate conflicts between states.
- Intelligence work can drift into surveillance of innocent people.
Who is affected
- Victims of attacks
- Wrongly accused parties
- Users of affected systems
Owners Filled
Steward
The organization that produces or receives it; sharing communities set rules for each exchange.
Links to other meta-models Filled
parent
- Q104845326 - registry parent class
- Q7406919 - registry parent class
What else AI and robots need to interact with it Filled
Identity and identifiers required Filled
- Vercy registry: vr.tr.cyber-threat-intelligence
- Wikidata: Q25053549 (https://www.wikidata.org/wiki/Q25053549)
Direct properties not applicable Not applicable
- Intelligence requirement: Linked decision owner, intelligence question, protected assets and decision deadline
- Intelligence orientation: Declared taxonomy, potentially strategic, operational, tactical or technical; multiple values allowed
- Analytical confidence: Explicitly named confidence scale with rationale and assessment date
- Assessed likelihood: Probability from 0 to 1 or a defined verbal scale, attached to a specified proposition and time horizon; unknown allowed
- Evidence lineage: Links from claims to observations, original sources, intermediaries and transformations
- Temporal applicability: Unassessed, current, review-due, superseded or expired, with observation and review dates
- Consumer relevance: Links to consumer technologies, sectors, locations, business dependencies and observed exposure, with supporting rationale
- Handling constraints: Source permissions, applicable sharing markings, audience restrictions and permitted uses
Plane ACT: no invented physical properties.
Recognition not applicable Not applicable
Not applicable
Cyber threat intelligence is evaluated information whose identity and quality cannot be established through visual cues.
Capabilities and actions required Filled
- Translate a defensive decision into prioritised intelligence requirements and collection gaps.
- Trace and compare threat claims while identifying duplicated reporting and unsupported inference.
- Develop competing explanations for cyber activity and identify evidence that would discriminate between them.
- Assess the relevance and freshness of indicators, behavioural patterns and threat assessments for a consumer.
- Prepare audience-appropriate intelligence products with uncertainty and handling constraints.
- Propose authorised defensive follow-up and revise intelligence using consumer feedback and subsequent observations.
Hazards and failure modes required Filled
- Outdated or poorly supported intelligence can trigger false alarms and misdirect defensive resources.
- Incorrect attribution can cause unjustified accusations and harmful organisational decisions.
- Sharing intelligence without appropriate controls can expose personal information or sensitive operational details.
- Treating intelligence as complete coverage can leave relevant threats unrecognised.
Standards and interfaces required Filled
- Structured Threat Information Expression (STIX), OASIS.
- Traffic Light Protocol, Forum of Incident Response and Security Teams (FIRST).
Context of use required Filled
- Cyber threat intelligence is used in security monitoring, incident response and organisational risk assessment.
- It helps defenders interpret observed activity, prioritise investigations and select protective measures using evidence about relevant threats.
Sources Filled
- Wikidata item Q25053549: cyber threat intelligence - identity and sense of the item
- Wikipedia: Cyber threat intelligence - general description of the item
Open questions
- Which authoritative and practitioner definitions should anchor this entry, and where do they disagree about when processed threat information becomes intelligence?
- Does the ACT placement require intelligence products to be represented through a neighbouring information model, and does an existing world model already own this concept?
- Which distinctions among strategic, operational, tactical and technical intelligence are sufficiently consistent to adopt, and which require provider-specific definitions?
- Which confidence, likelihood and source-evaluation conventions permit meaningful comparison across providers without erasing differences in method?
- What evidence supports practical review intervals and usefulness measures for indicators, behavioural assessments and strategic forecasts in different consumer environments?
Machine files
Provenance
thing registry research (pass 2) · unreviewed
Built from: models/things/publications/thing-q25053549/spec.json