This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Generating Threat Intelligence Reports
When to Use
Use this skill when:
Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership
Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign)
Generating sector-specific threat briefings for executive decision-making on security investments
Do not use this skill for raw IOC distribution — use TIP/MISP for automated IOC sharing and reserve report generation for analyzed, finished intelligence.
Prerequisites
Completed analysis from collection and processing phase (PIRs partially or fully answered)
Audience profile: technical level, decision-making authority, information classification clearance
TLP classification decision for the product
Organization-specific reporting template aligned to audience expectations
Workflow
Step 1: Determine Report Type and Audience
Select the appropriate intelligence product type:
Strategic Intelligence Report: For C-suite, board, risk committee
Content: Threat landscape trends, adversary intent vs. capability, risk to business objectives
Format: 1–3 pages, minimal jargon, business impact language, recommended decisions
Frequency: Monthly/Quarterly
Operational Intelligence Report: For CISO, security directors, IR leads
Content: Active campaigns, adversary TTPs, defensive recommendations, sector peer incidents
Format: 3–8 pages, moderate technical detail, mitigation priority list
Frequency: Weekly
Tactical Intelligence Bulletin: For SOC analysts, threat hunters, vulnerability management
Content: Specific IOCs, YARA rules, Sigma detections, CVEs, patching guidance
Format: Structured tables, code blocks, 1–2 pages
Frequency: Daily or as-needed
Flash Report: Urgent notification for imminent or active threats
Content: What is happening, immediate risk, what to do right now
Format: 1 page maximum, distributed within 2 hours of threat identification
Frequency: As-needed (zero-day, active campaign targeting sector)
Step 2: Structure Report Using Intelligence Standards
Apply intelligence writing standards from government and professional practice:
Headline/Key Judgment: Lead with the most important finding in plain language.
Bad: "This report examines threat actor TTPs associated with Cl0p ransomware"
Good: "Cl0p ransomware group is actively exploiting CVE-2024-20353 in Cisco ASA devices to gain initial access; organizations using unpatched ASA appliances face imminent ransomware risk"
Confidence Qualifiers (use language from DNI ICD 203):
High confidence: "assess with high confidence" — strong evidence, few assumptions
Medium confidence: "assess" — credible sources but analytical assumptions required
TLP:WHITE/CLEAR: Public distribution; no restrictions
Include TLP watermark on every page header and footer.
Step 5: Review and Quality Control
Before dissemination, apply these checks:
Accuracy: Are all facts sourced and cited? No unsubstantiated claims.
Clarity: Can the target audience understand this without additional context?
Actionability: Does every report section drive a decision or action?
Classification: Is TLP correctly applied? No source identification in AMBER/RED products?
Timeliness: Is this intelligence still current? Events older than 48 hours require freshness assessment.
Key Concepts
Term
Definition
Finished Intelligence
Analyzed, contextualized intelligence product ready for consumption by decision-makers; distinct from raw collected data
Key Judgment
Primary analytical conclusion of a report; clearly stated in opening paragraph
TLP
Traffic Light Protocol — FIRST-standard classification system for controlling intelligence sharing scope
ICD 203
Intelligence Community Directive 203 — US government standard for analytic standards including confidence language
Flash Report
Urgent, time-sensitive intelligence notification for imminent threats; prioritizes speed over depth
Intelligence Gap
Area where collection is insufficient to answer a PIR; should be explicitly documented in reports
Tools & Systems
ThreatConnect Reports: Built-in report templates with ATT&CK mapping, IOC tables, and stakeholder distribution controls
Recorded Future: Pre-built intelligence report templates with automated sourcing from proprietary datasets
OpenCTI Reports: STIX-based report objects with linked entities for structured finished intelligence
Microsoft Word/Confluence: Common report delivery formats; use organization-approved templates with TLP headers
Common Pitfalls
Writing for analysts instead of the audience: Technical detail appropriate for SOC analysts overwhelms executives. Maintain strict audience segmentation.
Omitting confidence levels: Statements presented without confidence qualifiers appear as established facts when they may be low-confidence assessments.
Intelligence without recommendations: Reports that describe threats without prescribing actions leave stakeholders without direction.
Stale intelligence: Publishing a report on a threat campaign that was resolved 2 weeks ago creates alarm without utility. Include freshness dating on all claims.
Over-classification: Applying TLP:RED to information that could be TLP:GREEN impedes community sharing and limits defensive value across the sector.
