annatchijova·annatchijova/SKILLS/intel-source-evaluation/SKILL.md

intel-source-evaluation

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Grade the source and the indicator before acting on either — because an indicator is not intelligence and a feed is not truth, and auto-acting on ungraded intel means blocking benign traffic, chasing decayed IOCs, and spending analyst trust on someone else's low-confidence guess. Use whenever threat intelligence arrives and something is about to act on it: "block all these IOCs", "we got a threat feed", "this indicator list from the ISAC", "is this intel reliable", "should we alert on this IOC", "the vendor says APT-X uses this", "add these to the blocklist", "how long is this IOC good for". Sibling of claim-provenance-discipline (intel is a claim that must carry its origin and confidence) and threat-attribution-restraint (the actor label attached to a feed is itself a graded claim); ranks by source reliability and indicator durability. It does not produce the intel or attribute the actor, and never auto-actions an ungraded feed as if a match were a verdict.