AbuseIPDB API reference. IP reputation and abuse report lookups.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
免费在 GitHub 公开
maturity-assessment
Use when assessing the maturity of a CTI programme, the user asks "how mature is our CTI?" / "what should we improve next?", or wants a benchmark against the five-level model across six dimensions.
中文简介正在准备中。当前显示原文说明。
实测评分 未实测
查看安装方法包含的文件（1）
- SKILL.md5.5 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
CTI Programme Maturity Assessment
Maturity Levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad-hoc | No formal CTI function. Reactive, incident-driven. Intelligence is incidental. |
| 2 | Emerging | Basic CTI capability. Some collection, limited analysis. Primarily tactical (IOC feeds). |
| 3 | Defined | Formal CTI function with documented processes. Strategic, operational, and tactical output. PIRs defined. |
| 4 | Managed | Mature CTI programme. Stakeholder-driven, measured effectiveness, feedback loops. Proactive intelligence. |
| 5 | Optimized | Intelligence-driven organisation. CTI informs all security decisions. Continuous improvement, advanced analytics, community contribution. |
Assessment Dimensions
1. Collection
| Level | Indicators |
|---|---|
| 1 | No systematic collection. Ad-hoc Google searches when incidents occur. |
| 2 | 1-2 threat feeds (usually free). No collection plan. |
| 3 | Multiple sources across OSINT, commercial feeds, ISACs. Collection plan exists. Source assessment applied. |
| 4 | Comprehensive collection mapped to PIRs. Source quality tracked. Dark web monitoring. Automated collection pipelines. |
| 5 | Full-spectrum collection. HUMINT relationships (ISACs, vendors, government). Predictive collection based on emerging threat indicators. |
2. Analysis
| Level | Indicators |
|---|---|
| 1 | No analysis. Raw data forwarded to SOC. |
| 2 | Basic enrichment (VirusTotal lookups). IOC correlation. No structured techniques. |
| 3 | Structured analysis applied. Threat assessments produced. ATT&CK mapping. Confidence levels used. |
| 4 | Full SAT toolkit (ACH, red team, horizon scanning). Knowledge cells maintained. Alternative hypotheses routinely considered. |
| 5 | Advanced analytics. Machine learning augments human analysis. Predictive threat modelling. Community-leading analysis. |
3. Production
| Level | Indicators |
|---|---|
| 1 | No intelligence products. Maybe an IOC spreadsheet. |
| 2 | Ad-hoc alerts and IOC lists. No standard templates. Inconsistent quality. |
| 3 | Standardised products (flash reports, assessments). TLP applied. Likelihood language used. Quality review process. |
| 4 | Full product suite tailored to stakeholder needs. Detection rules (SIGMA/YARA/KQL). STIX bundles for sharing. |
| 5 | Dynamic intelligence products. Real-time dashboards. Automated tactical output. Strategic foresight publications. |
4. Dissemination
| Level | Indicators |
|---|---|
| 1 | Intelligence stays within the CTI team. |
| 2 | IOCs pushed to SIEM/EDR. Some ad-hoc briefings. |
| 3 | Products reach defined stakeholders. TLP-governed sharing. Regular briefing cadence. |
| 4 | Tailored delivery per stakeholder. Integration with SOAR/TIP. Feedback collected. ISAC participation. |
| 5 | Intelligence embedded in all security workflows. Automated dissemination. External sharing (STIX/TAXII). Industry thought leadership. |
5. Management
| Level | Indicators |
|---|---|
| 1 | No CTI manager. Analyst works in isolation. |
| 2 | Informal CTI role. No PIRs. No stakeholder engagement. |
| 3 | Formal CTI function. PIRs defined and reviewed. Stakeholder register maintained. SOPs documented. |
| 4 | Programme measured on outcomes. KPIs tracked. Budget justified. Regular programme reviews. |
| 5 | CTI programme informs security strategy. Board-level reporting. CTI drives investment decisions. |
6. Tooling
| Level | Indicators |
|---|---|
| 1 | Email and spreadsheets only. |
| 2 | Free tools (VirusTotal, MISP community). Manual processes. |
| 3 | TIP deployed. OSINT tools in use. Some automation. |
| 4 | Integrated toolchain. API-driven enrichment. SOAR integration. Custom tooling where needed. |
| 5 | AI-augmented analysis. Full automation of tactical workflows. Custom detection engineering pipeline. |
Self-Assessment Questionnaire
For each dimension, select the level that BEST describes current capability:
## CTI Maturity Self-Assessment
**Date**: YYYY-MM-DD
**Assessed by**: [Name/Role]
| Dimension | Current Level | Target Level | Gap |
|-----------|:---:|:---:|:---:|
| Collection | _ | _ | _ |
| Analysis | _ | _ | _ |
| Production | _ | _ | _ |
| Dissemination | _ | _ | _ |
| Management | _ | _ | _ |
| Tooling | _ | _ | _ |
| **Overall** | **_** | **_** | **_** |
### Key Findings
[What are the biggest gaps?]
### Recommended Actions
1. [Highest-impact improvement]
2. [Second priority]
3. [Third priority]
### Timeline
[Realistic timeline for reaching target maturity]
Improvement Priorities
When improving maturity, prioritise in this order:
- Management (PIRs, stakeholders) — without direction, other improvements are wasted
- Collection — can't analyse what you don't have
- Analysis — transform data into intelligence
- Production — package intelligence effectively
- Dissemination — get intelligence to decision-makers
- Tooling — automate and scale (last, not first)
This order reflects a common mistake: organisations buy tools (Level 6) before establishing processes (Levels 1-5). Tools amplify process — if the process is broken, tools amplify the problem.
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
ach
免费Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Censys API v2 reference. Host reconnaissance and certificate data.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新