Hire an AI threat intelligence analyst

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A short brief that opens with what it means for you and what to do first
• A table of indicators, each with a source rating, a confidence level and a suggested action
• Facts from the report kept apart from the AI's own assessments
• Behaviors matched to MITRE ATT&CK, each with its evidence
• Draft Sigma, YARA or Snort detection rules, marked not tested (when the report supports them)
• A list of gaps and checks to run before you block or share anything

How it does the job well

• Defense only. Do not help contact threat actors, break into systems or run offensive operations. Do not give steps for hack-back. If asked, decline and say why.
• Respect handling labels. TLP:RED means TLP:RED. Do not suggest sharing wider than the label allows.
• If an attack is in progress, say that this brief is not incident response. Tell the user to contact their security team or provider now.
• Do not fabricate or inflate a threat to make a point or justify a budget.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: A vendor, CERT or news report lands and your team asks "does this affect us?"

• Bottom line. What the threat means for you, how sure the brief is, and the top three actions.
• Observations. Only what the sources said, each with its source and date.
• Indicators. Each indicator with a source rating, a confidence level, a suggested action and a review date.
• Assessments. What the AI thinks it means, with a confidence level, the reasons and what would change its mind.
• ATT&CK mapping. Each behavior matched to a technique, with the evidence for the match.
• Draft detection rules. Sigma, YARA or Snort rules built from the report, marked not tested, with likely false positives.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Set the question. It asks what decision the brief supports and who will read it, such as a SOC analyst or a board.
• Clean and rate the sources. It removes repeats, then rates each source for reliability and each fact for credibility, using the Admiralty scale.
• Split facts from opinion. It lists what the source said in one section and what the AI assesses in another, so you can see which is which.
• Match behavior to ATT&CK. It matches each behavior to a MITRE ATT&CK technique only when it can point to the evidence.
• Set the confidence. It gives low, medium or high confidence for each judgment and does not name a group from one indicator.
• Draft actions and rules. It suggests blocks, hunts and Sigma, YARA or Snort rules, matched to the reader, and marks every rule as not tested.
• List gaps and checks. It names the missing facts and the lookups you must run before you act or share.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-threat-intelligence-analyst only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-threat-intelligence-analyst/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The report, alert or indicator list, pasted as text
• Where each item came from (the vendor, a sharing group or your own logs) and its date
• Your kind of business and the systems you run, such as Windows or Microsoft 365 (optional)
• The decision you need to make, such as what to block this week (optional)
• The sharing label on the data, such as TLP:AMBER (optional)

Helpful context (optional)

• The alert that made you ask, with its time and the affected system.
• A list of the software and cloud services you run.
• Last month's alerts from the same source.

Tools and access

• Claude, ChatGPT or Gemini: You paste long reports and get a structured brief back. Claude Code can also save the rules as files.
• Your log search or security tool: The AI cannot search your network. You run each check there and paste the results back.
• A lookup site such as VirusTotal: You can check a hash, domain or IP there and paste what it says, so the AI can raise or lower its confidence.

Functions and deliverables

• Threat intelligence analyst agent: Turn a threat report or indicator list into a threat intelligence brief with confidence ratings, ATT&CK matches and draft detection rules.
  • A short brief that opens with what it means for you and what to do first
  • A table of indicators, each with a source rating, a confidence level and a suggested action
  • Facts from the report kept apart from the AI's own assessments
  • Behaviors matched to MITRE ATT&CK, each with its evidence
  • Draft Sigma, YARA or Snort detection rules, marked not tested (when the report supports them)
  • A list of gaps and checks to run before you block or share anything
  Source: Michael Sitarzewski and Agency Agents contributors.
• Microsoft threat model file builder: Describe components, users, data paths and trust boundaries. Get a Microsoft Threat Modeling Tool file draft with mapped threats.
  • A .tm7 file built for the Microsoft Threat Modeling Tool v7.3 or newer, from a bundled example structure (not tested by us in every version)
  • A diagram with shapes laid out so they do not overlap
  • STRIDE threats attached to each data flow
  • A check of the file against known mistakes that corrupt .tm7 files
  Source: GitHub Copilot community.
• Agent run evidence auditor: Share logs from an AI agent run. Get each success claim checked against real proof, with gaps marked.
  • A claim ledger with a verdict for each claim
  • Links to the records behind each verdict
  • A list of gaps and missing evidence
  • Conflicts between what was claimed and what was logged
  Source: sickn33.
• App security threat planner: Describe your app, users and sensitive data. Get a first threat list, entry points, practical safeguards and assumptions to check.
  • A list of parts and entry points
  • The top threats, ranked, with likelihood and damage
  • One practical fix for each
  • What was assumed and what to confirm
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• A vendor, CERT or news report lands and your team asks "does this affect us?"
• You have a list of IP addresses, domains or file hashes and need to know which to block first.
• You must tell a boss or a client what a threat means, in plain words, and how sure you are.
• You want a detection rule written from a report, to test in your own tools.

Limits to check before starting

• An attack is happening now. Call your security team or provider. The Security incident responder can help you plan the response.
• You only need detection rules for a known behavior, with no report. Use the Threat detection rule planner.
• You want live feed lookups, dark web watching or malware testing. A chat AI cannot do these. Use a threat feed or a sandbox tool.
• You need to name who attacked you for the police or a lawsuit. This brief gives a view with a confidence level, not proof. Ask a qualified investigator.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack and add it to your AI as a skill. Or paste SKILL.md into a new chat, then paste references/source-agent.md after it.
• Paste your report or indicator list. Add where each item came from, its date, and your kind of business and systems.
• Answer any question once. Anything you skip is marked MISSING, and the confidence goes down.
• Read "What this means for you" first, then the indicator table. Check one indicator against its source before you trust the rest.
• Run the checks it lists, such as searching your own logs for each indicator. A chat AI cannot do this for you. Paste what you find back in and ask it to update the brief.
• Test any rule on logs you know are good and logs you know are bad before you switch it on. Remove names and internal details before you share the brief.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-threat-intelligence-analyst for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.