Skip to main content

CTI Project Ecosystem

Purpose​

This page connects the three CTI documentation projects into one practitioner ecosystem. Each project has a different role, but they are intended to be used together.

The Ecosystem​

ProjectRoleUse When You Need
CTI Analyst Field ManualGeneral CTI tradecraft and analyst operating manualEvidence discipline, analytic judgment, attribution, infrastructure pivoting, actor research workflow, CTI-to-detection foundations, templates
CTI as a CodeLab platform and structured training frameworkHands-on practice applying the tradecraft in this manual — 8 assignments using evidence labels, claims ledger, ATT&CK gap taxonomy, Sigma rules, and git-based audit trails
Operation Desert HydraComplete CTI-to-detection pipeline on MuddyWaterWorked example of the full pipeline: source gathering → OpenCTI knowledge graph → 11 detection records → 14 PASS / 1 PARTIAL / 1 FAIL lab validation
Customer-Driven AI CTI ProjectDelivery methodology and customer engagement operating modelProject phases, quality gates, customer outcomes, AI-assisted workflow controls, acceptance criteria, replay and delivery packages
Israel Government Threat Actors CTISector and actor knowledge baseIsraeli public-sector threat model, actors, tools, TTPs, detections, hunts, evidence registers, source tracking
AI vs DefensePractitioner guide: AI-era threat model and SOC adaptationHow skill-floor collapse changes the Pyramid of Pain, legacy defense failures, behavioral detection, and CTI evolution requirements
AdversaryGraph AI CTI workbenchPublic Web workspace plus self-hosted Docker platformAnalyst-assisted ATT&CK mapping, group and campaign TTP-overlap leads, coverage-gap analysis, and detection-backlog support
The Intelligent Shield — OpenCTIAI-powered CTI platform deployment guideOpenCTI setup with STIX 2.1, free/commercial/ISAC feeds, Claude AI enrichment connector, inference rules, security hardening, and real investigation workflows
HexStrike AI (upstream project)AI-powered offensive security automation platformMCP agent-based tool orchestration, 150+ security tools, AI-driven penetration testing, adversarial validation of detection coverage
  1. Start here when you need the tradecraft standard: CTI Analyst Field Manual.
  2. Move to the delivery model when work must become a managed customer project: Customer-Driven AI CTI Project.
  3. Use the Israel-focused knowledge base when the question involves Israeli government, municipal, telecom, critical-infrastructure, or supplier exposure: Israel Government Threat Actors CTI.

Cross-Project Workflows​

Actor Profile to Customer Delivery​

Use Actor Research to structure the profile, then use Customer-Driven AI CTI Project to turn it into a project plan, quality gates, and accepted deliverables. Use Israel Government Threat Actors CTI when the actor requires Israel-sector context.

CTI Finding to Detection Backlog​

Use Intelligence to Detection for the reasoning chain. Use Customer-Driven AI CTI Project for phase control and gate evidence. Use Israel Government Threat Actors CTI for concrete actor, tool, TTP, hunt, and detection examples.

Source Claim to Evidence Register​

Use Evidence Labels and Source Reliability as the analytic standard. Use the Customer project for delivery gates. Use the Israel project for a live example of source and evidence governance.

Boundary​

The CTI documentation projects (Field Manual, Customer project, Israel CTI) are defensive and public-source oriented. They do not provide exploit instructions, malware source code, leaked data, credentials, or unauthorized-access guidance. The linked HexStrike AI upstream project is an authorized offensive security and penetration testing platform; use it only in authorized engagements.