{ "schema": "aiblocks-page/1", "id": "agency-security-threat-intelligence-analyst", "type": "agent", "name": "Threat intelligence analyst agent", "summary": "Turn a threat report or indicator list into a threat intelligence brief with confidence ratings, ATT&CK matches and draft detection rules.", "headline": "Threat intelligence analyst agent", "subhead": "Paste a threat report, a vendor alert or a list of indicators, and say what kind of business you run. It rates each source, keeps facts apart from opinions, matches behavior to MITRE ATT&CK and drafts detection rules you can test.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "document", "required": true, "label": "Document", "what": "a finished document, such as a Word file, a PDF or a page of notes" }, { "type": "question", "required": false, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" } ], "outputs": [ { "type": "audit_report", "required": true, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" } ], "you_give": [ "The report, alert or indicator list, pasted as text", "Where each item came from (the vendor, a sharing group or your own logs) and its date", "Your kind of business and the systems you run, such as Windows or Microsoft 365 (optional)", "The decision you need to make, such as what to block this week (optional)", "The sharing label on the data, such as TLP:AMBER (optional)" ], "you_get": [ "A short brief that opens with what it means for you and what to do first", "A table of indicators, each with a source rating, a confidence level and a suggested action", "Facts from the report kept apart from the AI's own assessments", "Behaviors matched to MITRE ATT&CK, each with its evidence", "Draft Sigma, YARA or Snort detection rules, marked not tested (when the report supports them)", "A list of gaps and checks to run before you block or share anything" ], "use_when": [ "A vendor, CERT or news report lands and your team asks \"does this affect us?\"", "You have a list of IP addresses, domains or file hashes and need to know which to block first.", "You must tell a boss or a client what a threat means, in plain words, and how sure you are.", "You want a detection rule written from a report, to test in your own tools." ], "skip_when": [ "An attack is happening now. Call your security team or provider. The Security incident responder can help you plan the response.", "You only need detection rules for a known behavior, with no report. Use the Threat detection rule planner.", "You want live feed lookups, dark web watching or malware testing. A chat AI cannot do these. Use a threat feed or a sandbox tool.", "You need to name who attacked you for the police or a lawsuit. This brief gives a view with a confidence level, not proof. Ask a qualified investigator." ], "output_sample": { "input": [ "A threat report, alert or list of indicators, pasted as text", "Where each item came from, and its date", "Your kind of business and the systems you run (optional)", "The decision you need to make (optional)" ], "prerequisites": [ "An AI chat that accepts long pasted text, such as Claude, ChatGPT or Gemini", "A way to run the checks it lists, such as your log search or a security tool" ], "output": [ { "name": "Bottom line", "contains": "What the threat means for you, how sure the brief is, and the top three actions." }, { "name": "Observations", "contains": "Only what the sources said, each with its source and date." }, { "name": "Indicators", "contains": "Each indicator with a source rating, a confidence level, a suggested action and a review date." }, { "name": "Assessments", "contains": "What the AI thinks it means, with a confidence level, the reasons and what would change its mind." }, { "name": "ATT&CK mapping", "contains": "Each behavior matched to a technique, with the evidence for the match." }, { "name": "Draft detection rules", "contains": "Sigma, YARA or Snort rules built from the report, marked not tested, with likely false positives." }, { "name": "Gaps and checks", "contains": "What is missing, which lookups to run before you act, and what to remove before you share." } ] }, "output_shape": "BOTTOM LINE\n | confidence | top 3 actions \n\nOBSERVATIONS (what the sources said)\n | source | date \n\nINDICATORS\n | type | source rating | credibility <1 to 6> | confidence | action | review by \n\nASSESSMENTS (what the AI thinks it means)\n | confidence | why | what would change it \n\nATT&CK MAPPING\n | technique | evidence \n\nDRAFT DETECTION RULES\n | NOT TESTED | likely false positives \n\nGAPS AND CHECKS\n MISSING | checks to run before you act | sharing label and what to remove before you share", "how_to_use": [ "Download the pack and add it to your AI as a skill. Or paste SKILL.md into a new chat, then paste references/source-agent.md after it.", "Paste your report or indicator list. Add where each item came from, its date, and your kind of business and systems.", "Answer any question once. Anything you skip is marked MISSING, and the confidence goes down.", "Read \"What this means for you\" first, then the indicator table. Check one indicator against its source before you trust the rest.", "Run the checks it lists, such as searching your own logs for each indicator. A chat AI cannot do this for you. Paste what you find back in and ask it to update the brief.", "Test any rule on logs you know are good and logs you know are bad before you switch it on. Remove names and internal details before you share the brief." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Threat detection rule planner", "url": "https://useaiblocks.com/skills/agency-security-threat-detection-engineer", "why": "Threat detection rule planner" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-intelligence-analyst.md", "licence": "MIT", "original_name": "Threat Intelligence Analyst", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Threat Intelligence Analyst", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-threat-intelligence-analyst.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions. On 2026-10-28 we matched the SKILL.md input note to the threat report input and added a when-not-to-use line." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-threat-intelligence-analyst", "markdown": "https://useaiblocks.com/agents/agency-security-threat-intelligence-analyst.md", "json": "https://useaiblocks.com/agents/agency-security-threat-intelligence-analyst.json", "instructions": "https://useaiblocks.com/skills/agency-security-threat-intelligence-analyst/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-threat-intelligence-analyst.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-threat-intelligence-analyst", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-threat-intelligence-analyst", "mcp": "https://useaiblocks.com/mcp" } }