abuseipdb-api
FreeAbuseIPDB API reference. IP reputation and abuse report lookups.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
FreePublished on GitHub
maturity-assessment
Use when assessing the maturity of a CTI programme, the user asks "how mature is our CTI?" / "what should we improve next?", or wants a benchmark against the five-level model across six dimensions.
The English summary is being prepared. Showing the original description.
See how to installFiles included (1)
- SKILL.md5.5 KB
SKILL.md (original)
Review the instructions the agent will receive before you install.
CTI Programme Maturity Assessment
Maturity Levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad-hoc | No formal CTI function. Reactive, incident-driven. Intelligence is incidental. |
| 2 | Emerging | Basic CTI capability. Some collection, limited analysis. Primarily tactical (IOC feeds). |
| 3 | Defined | Formal CTI function with documented processes. Strategic, operational, and tactical output. PIRs defined. |
| 4 | Managed | Mature CTI programme. Stakeholder-driven, measured effectiveness, feedback loops. Proactive intelligence. |
| 5 | Optimized | Intelligence-driven organisation. CTI informs all security decisions. Continuous improvement, advanced analytics, community contribution. |
Assessment Dimensions
1. Collection
| Level | Indicators |
|---|---|
| 1 | No systematic collection. Ad-hoc Google searches when incidents occur. |
| 2 | 1-2 threat feeds (usually free). No collection plan. |
| 3 | Multiple sources across OSINT, commercial feeds, ISACs. Collection plan exists. Source assessment applied. |
| 4 | Comprehensive collection mapped to PIRs. Source quality tracked. Dark web monitoring. Automated collection pipelines. |
| 5 | Full-spectrum collection. HUMINT relationships (ISACs, vendors, government). Predictive collection based on emerging threat indicators. |
2. Analysis
| Level | Indicators |
|---|---|
| 1 | No analysis. Raw data forwarded to SOC. |
| 2 | Basic enrichment (VirusTotal lookups). IOC correlation. No structured techniques. |
| 3 | Structured analysis applied. Threat assessments produced. ATT&CK mapping. Confidence levels used. |
| 4 | Full SAT toolkit (ACH, red team, horizon scanning). Knowledge cells maintained. Alternative hypotheses routinely considered. |
| 5 | Advanced analytics. Machine learning augments human analysis. Predictive threat modelling. Community-leading analysis. |
3. Production
| Level | Indicators |
|---|---|
| 1 | No intelligence products. Maybe an IOC spreadsheet. |
| 2 | Ad-hoc alerts and IOC lists. No standard templates. Inconsistent quality. |
| 3 | Standardised products (flash reports, assessments). TLP applied. Likelihood language used. Quality review process. |
| 4 | Full product suite tailored to stakeholder needs. Detection rules (SIGMA/YARA/KQL). STIX bundles for sharing. |
| 5 | Dynamic intelligence products. Real-time dashboards. Automated tactical output. Strategic foresight publications. |
4. Dissemination
| Level | Indicators |
|---|---|
| 1 | Intelligence stays within the CTI team. |
| 2 | IOCs pushed to SIEM/EDR. Some ad-hoc briefings. |
| 3 | Products reach defined stakeholders. TLP-governed sharing. Regular briefing cadence. |
| 4 | Tailored delivery per stakeholder. Integration with SOAR/TIP. Feedback collected. ISAC participation. |
| 5 | Intelligence embedded in all security workflows. Automated dissemination. External sharing (STIX/TAXII). Industry thought leadership. |
5. Management
| Level | Indicators |
|---|---|
| 1 | No CTI manager. Analyst works in isolation. |
| 2 | Informal CTI role. No PIRs. No stakeholder engagement. |
| 3 | Formal CTI function. PIRs defined and reviewed. Stakeholder register maintained. SOPs documented. |
| 4 | Programme measured on outcomes. KPIs tracked. Budget justified. Regular programme reviews. |
| 5 | CTI programme informs security strategy. Board-level reporting. CTI drives investment decisions. |
6. Tooling
| Level | Indicators |
|---|---|
| 1 | Email and spreadsheets only. |
| 2 | Free tools (VirusTotal, MISP community). Manual processes. |
| 3 | TIP deployed. OSINT tools in use. Some automation. |
| 4 | Integrated toolchain. API-driven enrichment. SOAR integration. Custom tooling where needed. |
| 5 | AI-augmented analysis. Full automation of tactical workflows. Custom detection engineering pipeline. |
Self-Assessment Questionnaire
For each dimension, select the level that BEST describes current capability:
## CTI Maturity Self-Assessment
**Date**: YYYY-MM-DD
**Assessed by**: [Name/Role]
| Dimension | Current Level | Target Level | Gap |
|-----------|:---:|:---:|:---:|
| Collection | _ | _ | _ |
| Analysis | _ | _ | _ |
| Production | _ | _ | _ |
| Dissemination | _ | _ | _ |
| Management | _ | _ | _ |
| Tooling | _ | _ | _ |
| **Overall** | **_** | **_** | **_** |
### Key Findings
[What are the biggest gaps?]
### Recommended Actions
1. [Highest-impact improvement]
2. [Second priority]
3. [Third priority]
### Timeline
[Realistic timeline for reaching target maturity]
Improvement Priorities
When improving maturity, prioritise in this order:
- Management (PIRs, stakeholders) — without direction, other improvements are wasted
- Collection — can't analyse what you don't have
- Analysis — transform data into intelligence
- Production — package intelligence effectively
- Dissemination — get intelligence to decision-makers
- Tooling — automate and scale (last, not first)
This order reflects a common mistake: organisations buy tools (Level 6) before establishing processes (Levels 1-5). Tools amplify process — if the process is broken, tools amplify the problem.
Reviews
No reviews yet. Tell others what you thought.
Comments
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
More skills from this repository
ach
FreeAnalysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
censys-api
FreeCensys API v2 reference. Host reconnaissance and certificate data.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026