How to Use Intel Requests | CTI Community Guide
Summary
The CTI - Cyber Threat Intelligence server has released a guide on how to effectively use the Intel Requests channel. Community members can request assistance with threat actor research, IOC context, and analytical validation while adhering to TLP:CLEAR guidelines. This process ensures that researchers can collaborate on complex security questions while maintaining proper tradecraft and information security standards.
intel-requests is where community members can request help answering a specific intelligence question or finding information related to something they’re researching.
Request help with things like:
- Threat actor or campaign information
- Infrastructure and IOC context
- Historical reporting and sources
- Malware information
- Attribution and OSINT research
- Detection and hunting information
- Connections between related activity
- Help validating an analytical finding
Tell us what you’re trying to determine, provide any useful context, and share what you’ve already found or checked when relevant.
Select the Open tag and the most relevant request type when posting. Once you’ve received what you need, update the request to Resolved.
Keep requests appropriate for TLP:CLEAR discussion and do not share confidential, client, employer, victim, or otherwise restricted information.
Current threat discussions belong in #threat-desk, and methodology, tooling, or analytical tradecraft discussions belong in #analyst-workbench.
