threat-intel-fusion

Threat Intel Fusion

Operating Rules

• Separate observation, assessment, and recommendation. Tag every claim with source, date, and confidence.
• Prefer structured formats: STIX 2.1 objects, MISP events, ATT&CK technique IDs, CVE IDs, CPE strings.
• Decay IOC value over time; mark sightings, first/last seen, and TLP.

Fusion Workflow

1. Collect: pull feeds with idempotent connectors; record raw payloads with hash and timestamp.
2. Normalize: map to STIX SDOs and SROs (indicator, malware, intrusion-set, attack-pattern, relationship).
3. Deduplicate: canonical-form domain/url/hash; merge by id + pattern, keep all sightings.
4. Enrich: passive DNS, WHOIS, ASN, geo, VT, GreyNoise tags, sandbox verdicts, KEV/EPSS scores.
5. Prioritize: score by exploitability, exposure in our environment, actor relevance, and decay.
6. Operationalize: emit firewall/EDR/SIEM-ready artifacts plus Sigma rules and hunt queries.

Actor Profiling

• Aliases, motivations, sectors, geographies, observed TTPs (ATT&CK), tooling, infrastructure patterns, recent campaigns, and likely next moves with confidence.

Output Contract

• feeds/: raw + normalized snapshots.
• iocs.stix.json: deduped STIX bundle with relationships.
• priority.csv: indicator, score, reason, action, ttl.
• actors/<name>.md: profile with sources.
• detections/: Sigma, YARA, Suricata, KQL, SPL exports.
• report.md: executive summary, what changed, what to action this week.