Introduction

What started out as a simple exploration into coding and trying to fill the CTI space with more solutions, has turned into a fully managed CTI program management solution. When I started building threatnote.io this time around, I wanted to actually turn it into a product that people could use, and be something that I would be engaged with and want to continue to update and innovate.

I have been reiterating this concept for some time, and with the lessons learned, I put together what we have now. One thing that's remained throughout the editions of threatnote.io is the practical examples behind it. I wanted a tool that has practical examples of how to run a CTI program. When people say "Ensure you keep an up-to-date Collection Management Framework", what exactly do they mean by that? What does a CMF actually look like? Similar to managing Intelligence Requirements, is that just a Confluence page with the requirement on it? (It sure can be, but again, what should one look like in practice?)

That's where we've landed at today, a practical implementation of a CTI program. It doesn't capture everything you need in a CTI program, but it focuses on the key elements of one, and enables teams to use a single place to document their findings, requirements, threat hunts, and more.

Often times, these elements are looked over in a traditional Threat Intelligence Platform, and aren't the "sexy" pieces of threat intel, like TTP's, IOC's, etc. but in the grand scheme of things, they are just as important in the success of a threat intel program.

Welcome to the new threatnote.io!