Threat Intelligence threat intelligenceCTIMISPCIRCL

Build Your Own Threat Intelligence Program

The anchor. Ten sections taking a small team from no capability to a running CTI program in ninety days, on MISP and the open-source CIRCL stack — with an honest ceiling on what a DIY program can ever do.

The build instruction for a threat intelligence capability that a small team can actually run, on open-source tooling, without a platform contract.

Section 1 comes before installation, and that ordering is the whole argument. Intelligence requirements and attack-surface worksheets get completed before anything is deployed, because collecting first is the commonest way these programs fail — you end up with a platform full of indicators and no way to say which of them matter to you.

Platform selection, deployment decisions, and a first-hour hardening checklist — the choices that are expensive to revisit once data is in the system.

The eight-criterion feed selection rubric with a cut threshold, so "should we take this feed?" produces a defensible number and, more importantly, a defensible no. The companion Feed Selection Matrix applies this rubric to 62 real sources.

A whole section on warninglists — the highest-value setting in MISP and the most consistently skipped. This is what stops your platform confidently flagging your own DNS resolvers and the major CDNs as adversary infrastructure.

Taxonomy and tagging policy, decay configuration, sharing and trust groups — the operating decisions that determine whether the platform is still useful in year two or has quietly filled with indicators nobody trusts.

The agent layer, analyst operating cadence, and metrics that are not vanity. Counting indicators ingested is a vanity metric. The workbook covers the ones that survive a question from someone who controls budget.

Section 10 states the honest ceiling — no attribution, no finished intelligence, no off-hours cover. A DIY program does collection and enrichment well, and the section says plainly which capabilities you should consume from people equipped to produce them rather than attempt yourself.

Twelve worksheets throughout and a 30/60/90 day plan.

The assessment tells you where you are; this tells you what to build. Every gap the assessment reports names a section here.

Also available in 2 bundles

This product is sold on its own and as part of a set. If you need more than this one, the set is cheaper than buying the parts.

3 products saves $78.00

CTI Essentials

The three products that get a program running — the build workbook, the maturity assessment, and the feed matrix. 30% off buying separately.

$143.20

6 products saves $255.00

Threat Intelligence Starter Kit

All six CTI products — assessment, auto-scoring tool, the build workbook, the feed matrix, eighteen analyst runbooks and the policy pack. 39% off buying separately.

$319.20