Evidence-labeled cyber threat intelligence reports designed to become hunts, detections, pivots, and defensible assessments.
Add screenshots of one HTML report, the evidence-label rubric, and the template directory.
This repository is for CTI analysts, SOC leads, and detection engineers who need structured threat reports with explicit confidence discipline. Each report should make clear what is observed, reported, assessed, or claimed.
| Output | Use |
|---|---|
| PDF report | Formal reading and sharing |
| HTML report | Web review |
| Evidence labels | Claim discipline |
| Actor notes | Research continuity |
| Templates | Repeatable CTI production |
| Report | Format | Evidence model | Assessment confidence summary |
|---|---|---|---|
| Handala / Void Manticore | PDF + HTML | Observed / Reported / Assessed / Claimed | [user: confirm summary] |
| Sandworm / APT44 | PDF + HTML | Observed / Reported / Assessed / Claimed | [user: confirm summary] |
| MuddyWater / Seedworm | PDF + HTML | Observed / Reported / Assessed / Claimed | [user: confirm summary] |
git clone https://github.com/anpa1200/CTI.git
cd CTI
find . -maxdepth 3 -type f | sortflowchart LR
Sources[Sources] --> Evidence[Evidence labeling]
Evidence --> Assessment[Analytic assessment]
Assessment --> Attack[ATT&CK mapping]
Attack --> Detection[Hunts / detections]
Detection --> Report[PDF / HTML report]
| Area | Coverage |
|---|---|
| Actors | Handala / Void Manticore, Sandworm / APT44, MuddyWater / Seedworm |
| Labels | Observed, Reported, Assessed, Claimed |
| Outputs | PDF, HTML, templates |
| Use case | CTI, SOC handoff, detection planning |
- Israel CTI knowledge base: https://1200km.com/israel-government-threat-actors-cti/
- CTI Analyst Field Manual: https://1200km.com/cti-analyst-field-manual/
- Attribution Methodology: https://medium.com/@1200km/attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced
- Infrastructure Pivoting: https://infosecwriteups.com/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-network
- ATT&CK as a Working Tool: https://medium.com/@1200km/att-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101
Use the report title, repository URL, commit hash, and access date. See CITATION.cff.
See RESEARCH-CHARTER.md.
Public-source CTI is bounded by available reporting. Reports should not overstate attribution beyond evidence quality.
CC BY 4.0 recommended for reports and prose.
See SECURITY.md.