Threat Intelligence threat intelligenceCTIrunbooksSOC

CTI Analyst Runbook Library

Eighteen procedures for the things that actually land in an analyst queue. One page each, each ending in a decision rather than a suggestion — with an escalation matrix and an execution log.

Eighteen runbooks for the work that actually arrives: not a taxonomy of threat intelligence, but the specific things that land in the queue on a Tuesday and need a decision before the end of the day.

Intake — KEV entries, edge-device CVEs, community indicators, vendor breach notifications, and the bulk report drop that arrives as a PDF with forty indicators in it.

Exposure — infostealer credentials appearing for your domain, leak-site mentions, sector ransomware activity, and lookalike domain registrations.

Data quality — false-positive investigation, decay audit, source onboarding and source retirement. This is the category most libraries skip and the one that decides whether anyone still trusts the platform in year two.

Production — actor profiles, pivot investigations, and the weekly brief.

Governance — sightings submission and TLP handling disputes.

Each runbook is one page and ends in a decision. Some of those decisions are the reason to buy the library rather than write your own:

Revoke sessions before rotating a password — the usual order leaves the stolen session alive, and a stolen session does not care that the password changed.

Repeated false positives are a source problem, not an indicator problem. Stop fixing the indicators and suspend the source.

Nothing goes to detection on its first day, however well regarded the source is.

Includes an escalation matrix — who gets woken, for what, and when it can wait until morning — and an execution log so the runbooks accumulate evidence that the procedures are actually being run.

Ships as a print-ready PDF and an editable Word master, so the procedures can be adapted to your own escalation paths and tooling.

Also available in a bundle

This product is sold on its own and as part of a set. If you need more than this one, the set is cheaper than buying the parts.

6 products saves $255.00

Threat Intelligence Starter Kit

All six CTI products — assessment, auto-scoring tool, the build workbook, the feed matrix, eighteen analyst runbooks and the policy pack. 39% off buying separately.

$319.20