How is intel collected?¶

1. Where does data come from?¶

The solution begins with 46 curated RSS and Atom feeds selected for security and threat-intelligence value. They cover:

security-vendor and primary-source research;
threat-research organizations;
government and vulnerability advisories;
exploit and malware reporting;
security news and summary publications;
selected independent researchers.

The curated list creates the first quality boundary. Collection begins with publishers intentionally selected for useful security reporting rather than an unrestricted crawl of the web.

Collection runs once per hour. Each feed receives a 20-second download window, followed by a half-second pause before the next feed. A feed failure is recorded while collection continues with the remaining sources, limiting the effect of a slow or malformed publisher.

For every feed entry, the process:

Requires a usable title and link.
Reads the publication time, using the published timestamp or updated timestamp supplied by the feed.
Admits entries from the previous 24 hours.
Applies the threat-intelligence title rules.
Collapses repeated exact links found during the same collection run.
Combines qualifying entries from every feed.
Orders the complete eligible set newest first.

The collector processes the full qualifying set. An observed run containing ten articles represented the entries available during that run rather than a configured ten-article limit.

The 24-hour admission window keeps the working population current. Hourly repetition gives newly published and recently updated research repeated opportunities to enter the pipeline.

2. How are titles selected?¶

Every title passes through two complementary rule groups:

narrow content-quality and format exclusions;
strong threat-intelligence allow overrides.

The decision sequence is:

Normalize the title for consistent comparison.
Search first for strong intelligence signals.
Retain the entry when one of those signals is present.
For the remaining titles, compare the normalized text with the quality exclusions.
Remove a title that matches the quality policy.
Retain titles that pass those checks.

Strong allow signals include patterns such as:

CVE identifiers;
exploitation;
malware;
ransomware;
APT activity;
vulnerability research;
other explicit offensive or defensive security terminology.

The allow decision takes precedence. For example, a broad technology term may normally correlate with routine product or business reporting, while a CVE or exploitation reference establishes direct security value and permits the article to proceed.

This gate filters sponsored material, webinars and conferences, hiring and career content, funding or acquisition announcements, podcasts, routine product announcements and similar non-research formats before resources are spent fetching and scoring full pages. Identity, endpoint, email, cloud, SaaS, fraud, breach and software-supply-chain reporting are not rejected merely because they lack a network-detection angle.

3. How is the full article retrieved?¶

Each admitted URL is requested with a browser-like identity and a 20-second timeout. Up to 5 MB of returned HTML is considered.

The main text is extracted in this priority order:

Structured JSON-LD containing an articleBody of at least 400 characters.
Scored semantic containers such as article and main regions.
Scored elements identified as the page's principal content.
Common publisher content containers.
Scored generic divisions and sections.
A cleaned whole-body fallback.

Before a block is evaluated, the page is cleaned of navigation, scripts, styles, advertisements, social controls, related-story blocks and other page furniture.

Structured article data receives priority because it often contains the publisher's clean article body. The additional ranked methods support publishers with custom layouts or incomplete metadata.

The initial body is normalized, converted to lowercase and capped at 12,000 characters. The response and text limits keep unusually large pages from monopolizing an hourly run while preserving enough material for tagging, source discovery and scoring.

4. How is extraction quality classified?¶

The retrieved content receives a classification such as:

ok;
primary_research;
likely_wrapper;
recap_or_roundup;
low_signal;
too_short;
an HTTP access outcome;
extract_failed.

The status can also identify which extraction method produced the text.

These classifications guide later choices:

usable content proceeds to tagging and scoring;
primary research receives favorable source treatment;
wrapper-like reporting enters upstream-source discovery;
short or blank content enters repair;
HTTP and extraction failures preserve an explicit bounded reason for later retry and review.

This distinction prevents an access page, menu or short recap from receiving the same treatment as a detailed technical campaign report.

5. How are article records inserted and updated?¶

The exact URL is the initial article identity key.

A new exact URL creates an article record. When the URL already exists, the automated refresh updates it only while the record remains active and unsaved. An analyst-saved record preserves its maintained state, and a disposed record preserves its disposition. Normal reparsing also preserves prior enrichment fields.

This behavior allows repeated feed appearances to improve ordinary active records without reversing analyst choices.

Exact-string identity means tracking-query variants, alternate canonical URLs, HTTP/HTTPS variants and syndicated copies can initially appear separately. Canonical-source promotion and duplicate folding handle stronger relationships later in the process.

6. How are deterministic tags assigned?¶

The title and article body are compared with a curated vocabulary covering:

CVE identifiers;
threat actors;
malware families;
ransomware families;
exploitation terms;
selected countries;
campaigns;
delivery vectors;
other threat-intelligence concepts.

Tag generation applies to useful content classes such as ok, primary_research and likely_wrapper.

Actor, malware and ransomware dictionary tags generally require at least two textual mentions. Requiring repeated evidence reduces labels caused by a single incidental reference.

These deterministic tags provide an explainable initial classification. Model-suggested and analyst-approved tags retain separate states so their origin remains clear.

7. Why is the title policy applied again after storage?¶

The current title policy is reapplied to active, unsaved records after insertion. This second gate covers:

records collected under an older rule set;
records imported through another route;
records whose title changed;
current allow-override behavior.

A matching quality-policy record is soft-deleted with an explicit reversible reason, preserving its history and provenance while removing it from routine queues. Network Actionability does not control this common-corpus decision.

Saved records retain analyst protection.

8. How is missing article text repaired?¶

Each hourly run selects up to 50 of the newest active articles whose body remains blank.

For each selected record, the repair process:

Refetches the URL with a 20-second timeout.
Follows redirects.
Confirms that the response resembles HTML or XML.
Repeats structured-data, semantic-container and fallback extraction.
Retains the fuller extracted result.
Requires at least 80 words.
Requires at least three nonempty lines.
Stores the method, time and outcome.

A failed attempt clears unusable text and records a bounded extraction-failure reason.

The 80-word and three-line requirements help distinguish meaningful reporting from cookie notices, access pages, menus and other non-article responses. A dedicated repair pass gives temporary publisher or extraction problems another opportunity while the primary collection sequence continues.

9. How does the solution identify wrapper articles?¶

Security news frequently summarizes research published elsewhere. Upstream-source discovery examines:

records classified as likely wrappers;
usable records originating from known news or wrapper publishers.

The wrapper page is fetched and its outbound links are collected. Relative links are resolved, fragments are removed and duplicate candidates are collapsed.

Links that resemble navigation, category pages, account pages, social profiles, generic homepages, evergreen references, tutorials, changelogs, product histories or sales material are filtered before deeper evaluation.

This concentrates candidate fetching on citations that may contain the underlying technical evidence.

10. How are possible original sources ranked?¶

Every remaining outbound link receives a source-link score.

The score increases when:

the candidate uses a different domain from the wrapper;
the destination is a recognized primary-research source;
the anchor refers to research, analysis, technical details or a proof of concept;
the surrounding sentence uses citation language;
the anchor overlaps with the wrapper title;
the link names the relevant vulnerability, malware or campaign;
the wrapper uses phrases such as “first reported by” or “published research”;
the link points to a PDF report.

The score decreases when:

the candidate remains on the same domain;
the candidate belongs to another news or wrapper publisher;
the destination is a root homepage;
the candidate path duplicates the wrapper path;
the URL is dominated by a fragment or tracking parameters.

Only the five strongest link candidates proceed to full-page evaluation. This prevents a page containing hundreds of unrelated links from generating hundreds of expensive fetches.

11. How is candidate-source content evaluated?¶

Each of the five strongest candidate pages is fetched. Up to 5 MB of HTML and up to 15,000 extracted characters are considered.

Candidate-content scoring rewards:

a different domain;
a preferred research organization;
substantially more content than the wrapper;
more than 250 words;
CVE references;
title relationship to the wrapper;
technical evidence absent from the summary.

It reduces confidence for:

another wrapper publisher;
very short content;
weak title relationship;
generic reference or documentation pages;
tutorials, changelogs and product histories;
cookie walls, homepages and sales pages.

The source-link and content scores are combined. A candidate generally needs a combined score of at least 62 to be retained as a viable source. Weak title overlap requires stronger evidence such as a recognized primary-source domain, explicit citation text, a long technical article or a very high combined score. A wrapper-to-wrapper candidate requires a score of at least 95.

The strongest accepted candidate retains its URL, title, extracted text, extraction status and score. Distinct outcomes record wrapper-fetch failure, absence of useful links, candidate-fetch failure and insufficient candidate score.

12. When is a better source promoted automatically?¶

Automatic promotion uses a stricter decision than candidate discovery. Every condition below must hold:

candidate score of at least 85;
candidate body containing at least 400 words;
candidate body at least 150 words longer than the wrapper;
candidate domain different from the wrapper domain;
candidate domain outside the known wrapper set;
successful candidate extraction;
candidate URL unused by every other article record.

A score of 62 means that a source is worth presenting as a candidate. The score of 85 plus richer-content requirements establishes enough confidence for automatic replacement.

A successful promotion:

replaces the wrapper title, URL and body with the upstream source;
preserves the original article age;
retains wrapper provenance;
clears wrapper-derived tags, summaries, behavior fields and network scores;
invalidates stored Financial Sector Relevance and Detection Opportunity judgments tied to the former body;
clears candidate fields;
sends the promoted content through later enrichment and scoring again.

Recalculation prevents evidence extracted from a short summary from remaining attached to a stronger primary source.

13. How can an analyst control source promotion?¶

Analysts can inspect the candidate score, title, URL, status and a content preview. They can refetch, reject or promote the candidate, and they can supply a manually selected HTML or PDF source.

Manual source validation uses:

a 30-second timeout;
HTML or PDF extraction;
up to 15,000 retained characters;
a minimum of 50 words;
extended PDF handling before normalization.

A validated analyst-selected source receives a deliberately dominant candidate score of 1000, representing explicit human selection.

When a selected source URL already belongs to another article, the relationship is surfaced rather than silently creating a collision. Existing disposed records can retain their history under an archived identity, and related wrappers can be folded toward the canonical article.

This route covers PDFs, JavaScript-heavy pages, obscure research domains and source relationships that require editorial judgment.

14. How is source quality represented?¶

Each article receives source characteristics derived from domain rules and a curated publisher catalog:

source name;
source type;
quality bucket;
priority weight;
primary-research flag;
campaign-research bias;
network-detection bias;
whitepaper bias;
wrapper likelihood.

Source metadata acts as a bounded prior. Known research quality contributes modest bonuses, while the article still needs concrete technical evidence.

Promoted records can retain provenance metadata originating with their former wrapper feed. For this reason, source labels, article content and recorded score reasons should be interpreted together.

15. How is automated model enrichment used?¶

Current scheduled model use concentrates on structured scoring and review. Broad article enrichment remains available for supported analyst-driven or enabled operating modes and can produce:

summaries;
suggested and rejected tags;
behavior steps;
detection notes;
confidence and status metadata.

Existing enrichment fields remain available as evidence when present. Model work uses persistent cached jobs, bounded batches and per-article outcomes so one article-level failure has a limited effect on the remaining population.

16. How is Network Actionability calculated?¶

Network Actionability asks:

How useful is this article for network detection engineering, network hunting or a realistic intel2pcap scenario?

The queue contains active articles with usable text, ordered by publication time and stable article identity. Up to 50 of the newest unscored records are processed in a normal hourly run.

The score ranges from 0 through 100 and combines deterministic evidence with an optional structured model contribution.

Protocol evidence¶

Each protocol family contributes:

min(6 + occurrences, 10)

The cap rewards repeated support while preventing repetition from dominating the score.

Observable evidence¶

Each observable family contributes:

min(base + occurrences, base + 4)

The base is:

12 for packet-byte evidence;
7 for other observable classes.

Packet bytes receive the strongest base because they can support highly specific packet or protocol analytics.

Behavior evidence¶

Each behavior family contributes:

min(6 + occurrences, 10)

Behavior evidence includes callbacks, beaconing, discovery, payload retrieval, protocol misuse, recurring URI or header behavior and staged communication sequences.

Research and campaign evidence¶

Primary technical-source and actor/campaign signals can each contribute up to 14 points.

Evidence-combination bonuses¶

The score adds:

+10 for multiple protocols combined with multiple observables;
+8 for at least three observable families;
+8 for at least two behavior families;
+4 for article text longer than 1,200 words.

These bonuses reward relationships among evidence rather than isolated keywords.

Source adjustments¶

Source metadata can add:

half the source-priority weight, capped at +15;
+6 for primary research;
+4 for campaign focus;
+5 for network-detection focus;
+4 for whitepaper characteristics;
+4 when an upstream candidate exists;
another +5 when that candidate scores at least 85.

Low-value penalties¶

The score is reduced for:

advertorial characteristics: approximately 35 points plus a bounded occurrence adjustment;
routine product-update characteristics: approximately 24 points plus a bounded occurrence adjustment;
unknown delivery details: −28;
absence of concrete observable families: −18;
a single thin observable family: −8;
article body under 250 words: −10;
a high-wrapper source: −22;
wrapper status without a better candidate: another −18;
mobile-only emphasis: approximately −10;
advertorial language combined with thin technical evidence: an additional penalty.

The deterministic score is clamped from 0 through 100.

This formula rewards protocol-plus-observable and behavior-plus-timing combinations. It reduces the priority of articles that announce a threat, incident or product while supplying little observable communication detail.

17. How does structured review contribute to Network Actionability?¶

When structured review is enabled, the reviewer receives:

title;
source URL;
a bounded article body;
deterministic score;
deterministic reasons.

It evaluates:

packet evidence;
protocol detail;
network observables;
behavior chains;
reproducibility;
logging visibility;
TLS visibility;
marketing characteristics;
practical detection-engineering value.

The reviewer can contribute from 0 through 30 additional points. The final result is:

clamp(deterministic score + structured-review contribution, 0, 100)

The stored outcome includes the deterministic score, model contribution, final score, reasons, notes, status and scoring time.

The deterministic component provides explainability and consistency. The structured component evaluates context, including whether technical terms describe the actual threat, whether listed indicators support a meaningful analytic and whether encrypted traffic still exposes useful DNS, SNI, certificate or flow behavior.

18. How is Financial Sector Relevance calculated?¶

Financial Sector Relevance asks:

Does this article align with the selected financial-services intelligence profile?

It is calculated independently from Network Actionability and Detection Opportunity.

The title, body, tags, summaries, behavior and source fields are evaluated against five weighted groups:

Financial-sector alignment: 30 points
Business or crown-jewel category: 20 points
Priority attack path: 25 points
Operational consequence: 15 points
Threat-campaign alignment: 10 points

One or more matches in a group award that group's full weight. Repetition inside the same group keeps the same weight. A report mentioning a bank twenty times therefore receives the same sector-group value as a report that establishes the banking context once.

An excluded-term match assigns a score of zero. This supports firm suppression of material outside the selected organizational mission.

The maximum score is 100. Priority bands are:

P0: 90–100
P1: 70–89
P2: 40–69
Monitor: 20–39
Background: below 20

The Financial Sector workspace requires a current-version score of at least 55. Missing or stale-version profile scores remain outside that workspace until recalculated.

This score acts as an organizational population filter. It expresses relevance to the selected financial profile rather than detection quality.

19. How is Detection Opportunity calculated?¶

Detection Opportunity asks:

Does the evidence support a defensible detection across one or more telemetry sources?

The current review version is detection_opportunity_v1. Up to 50 previously unreviewed articles enter a normal hourly batch. Candidates are ordered by existing AI confidence, publication time and stable article identity.

The score is the exact sum of five dimensions:

Evidence specificity: 0–25¶

Measures concrete evidence such as commands, registry locations, process relationships, protocol fields, paths, account activity, API calls, event patterns and infrastructure relationships.

Behavior and relationship specificity: 0–20¶

Measures how actions connect, including parent-child processes, user-to-session transitions, domain-to-IP relationships, attachment-to-process chains, cloud identity sequences and staged attack behavior.

Telemetry feasibility: 0–20¶

Measures whether common enterprise telemetry can observe the behavior. Supported families include:

network;
endpoint;
identity;
cloud;
SaaS/API;
email;
data and fraud;
cross-source correlation.

Behavioral distinctiveness: 0–20¶

Measures how effectively the behavior separates suspicious activity from normal operations.

Analytic composability: 0–15¶

Measures whether the evidence can be assembled into a detection, hunt, correlation, sequence, risk rule or reusable analytic.

The total ranges from 0 through 100.

The structured review assigns one of five dispositions from the evidence:

build_now;
research_needed;
telemetry_gap;
ioc_only;
not_detection_material.

Disposition is based on the structure of the evidence rather than a fixed score conversion. An indicator list without meaningful behavior or analytic logic ordinarily receives ioc_only.

Unreviewed articles retain an explicit unreviewed state. The interface does not infer a Detection Opportunity value from another score.

20. Why are the three judgments independent?¶

The three judgments answer different operational questions:

Network Actionability: Can this material support network detection engineering?
Financial Sector Relevance: Does this material match the selected organizational intelligence profile?
Detection Opportunity: Can the evidence support a useful detection across available telemetry?

Examples illustrate the separation:

A financially relevant fraud campaign may provide strong identity and transaction analytics while offering little packet detail.
A protocol-research paper may be exceptionally useful for network engineering while having low financial-sector specificity.
A vulnerability announcement may match a financial profile while lacking enough behavior to build a reliable analytic.
A detailed endpoint intrusion chain may earn strong Detection Opportunity despite moderate Network Actionability.

Changing the workspace changes the population presented to the analyst. It preserves the underlying independent judgments.

21. How are low-value records dispositioned?¶

After scoring, automatic housekeeping evaluates content quality, article age, source candidates, analyst protection and duplicate relationships.

General age-based deletion uses a two-day minimum. Certain obvious title classifications can receive immediate treatment, while other low-value decisions wait for age and absence of analyst protection.

Global disposal is limited to content-quality or objectively unusable records, canonical duplicate handling and explicit analyst disposition. A low Network Actionability score can route material away from network-specialized products, but it does not delete the article from the common corpus.

The delay provides time for:

text repair;
source discovery;
source promotion;
scoring;
analyst review;
manual enrichment.

22. How are network-specialization holds assigned?¶

Network holds are evaluated for Network Actionability scores from 31 through 89 after a minimum age of three days.

Common reasons include:

unknown delivery mechanism;
decryption dependence without enough visible protocol detail;
indicator-oriented material without protocol detail;
a score of at least 60 combined with thin protocol evidence.

A network hold routes the article away from High Value Results and intel2pcap while preserving it for broad endpoint, identity, cloud, email, data/fraud and cross-source analysis.

This keeps network-specialization limits from becoming a global judgment about the article's intelligence value.

23. How are duplicates and wrappers folded?¶

Related records are grouped using evidence such as:

the same promoted or candidate source URL;
shared CVEs in a sufficiently large group;
at least three shared indicators;
indicator overlap meeting the 0.70 configured threshold;
very high indicator overlap;
indicator overlap combined with meaningful title-token similarity.

The canonical article is selected by considering:

Primary-source authority.
Non-wrapper source quality.
Source-priority metadata.
Evidence richness across article text and general enrichment.
Higher source-candidate score.
Stable article identity as a deterministic tie-breaker.

Noncanonical records point to the canonical article and leave ordinary active queues while remaining available for provenance and recovery.

24. Which articles appear in the main Articles population?¶

The broad Articles population requires:

an active record;
an active global review state.

Records already folded, deleted, rejected, archived, held globally or exported through the indicator workflow leave the routine population. Network scores, network holds and network dismissals do not remove an article from All Intelligence or an applicable organizational view.

Unscored and low-network-score articles remain visible while independent Financial Sector and Detection Opportunity judgments are calculated. Network score thresholds apply only to explicit network views and products.

At the production snapshot inspected on 2026-09-05:

566 records qualified for the common All Intelligence population;
56 of those active records had Network Actionability of 30 or lower and remained available for broader analysis.

These counts change as hourly collection and review continue.

25. How does workspace scope affect the population?¶

All Intelligence presents the broad eligible population.

Financial Sector applies an additional population rule:

current financial profile version;
Financial Sector Relevance of at least 55;
broad Articles eligibility.

Workspace scope answers “relevant to which mission?” after the article's technical evidence has been recorded. The same article retains one evidence record while different views apply organizational priorities.

26. How do analyst filters and sorting work?¶

After eligibility and workspace scope are established, analysts can filter by:

text;
source;
tag;
saved state;
publication age;
score range;
direct article identity;
workspace.

Available sorting includes:

Newest;
Highest Detection Opportunity;
Highest Financial Sector Relevance in scoped workspaces;
Highest Network Actionability.

Score sorting uses deterministic publication-time and record-order tie-breakers. Articles awaiting Detection Opportunity review display unreviewed and appear after reviewed records when sorting by that score.

Filters and sorting help analysts navigate an already selected population while preserving scores and workflow state.

27. Which analyst decisions can be made from an article?¶

An analyst can:

save or unsave the article;
edit its title, URL, body and tags;
approve or reject suggested tags;
inspect, refetch, reject or promote a better source;
copy it to Behavioral Intelligence;
copy it to Behavioral Intelligence and remove it from Articles;
stage its indicators for review and remove it from Articles;
create an advanced MISP event directly;
suppress or restore article-level indicator eligibility;
soft-delete it;
apply supported bulk actions.

Saving protects selected analyst-maintained state and cleanup decisions. It remains distinct from High Value qualification.

“Copy to Behavior” creates a behavioral record while retaining the article. “Behavior + Remove” creates that record and then removes the source article from the normal population.

“Stage IoCs + Remove” creates or updates a reviewable workbench batch, invokes bounded contextual review and records the source disposition as exported to the MISP/CSV workbench.

The advanced direct-MISP path creates an event immediately and preserves the source article. It is intended for deliberate expert use.

28. How are High Value Results selected?¶

High Value Results is a network-specialized population requiring:

an active article;
Network Actionability of at least 90;
an active global review state;
an active network-review state.

Results are ordered by Network Actionability, publication time and stable article identity.

The threshold of 90 represents a concentrated combination of protocol evidence, observables, behavior, source quality and structured network-review confidence.

Generated material includes:

article evidence;
score reasons;
extracted indicators;
quick-win candidates;
source references;
article drill-down material.

Quick wins are candidate indicators for analyst review. They become operational intelligence through the review and publication paths described below.

29. How are indicators extracted and validated?¶

The indicator flow supports values such as:

IP addresses;
domains;
URLs;
file hashes;
ports;
other supported intelligence types.

Common defanged forms are normalized and equivalent values are grouped.

Validation removes or suppresses:

publisher and source domains;
reserved and private addresses;
file paths and file names;
code symbols;
malformed values;
navigation artifacts;
unsupported structures.

This contextual cleaning prevents article furniture, documentation links and example values from being presented as threat intelligence.

30. How are automated indicator decisions made?¶

Automated policy can:

keep IP addresses and hashes;
discard ports;
use domain prevalence to discard highly common domains and root URLs;
preserve common multi-tenant providers for contextual review;
use enrichment results to retain likely threat-related values;
leave inconclusive indicators unresolved.

Common cloud and hosting providers remain reviewable because a specific tenant, path or subdomain can represent attacker-controlled infrastructure even when the parent platform is widely used.

31. How are indicators reviewed by an analyst?¶

Each indicator can receive a persistent decision:

keep;
edit;
discard;
unresolved.

A bounded contextual reviewer can evaluate supplied indicators against the article, identify source/self-reference values and suggest missing candidates.

Unresolved values remain available for analyst disposition and supported export behavior. Bulk review controls can apply discard to unchecked values in the current review set.

Persistent decisions ensure that a refresh does not erase completed review work.

32. How is a MISP and CSV workbench batch constructed?¶

A staged batch contains:

source article;
event title;
TLP;
analysis level;
threat level;
distribution;
MISP tags;
source references;
grouped indicators;
per-indicator state;
review status.

Initial staging commonly uses tlp:clear, article-derived tags, source comments and IDS flags for actionable attributes.

The workbench creates a human approval boundary between automatically extracted candidates and publishable intelligence. It also preserves an audit trail of edits and discarded attributes.

33. How are workbench outputs reviewed and published?¶

Analysts can edit:

event title;
analysis level;
threat level;
distribution;
TLP;
tags;
attribute type;
category;
value;
comment;
IDS flag;
correlation flag;
timestamp.

They can also add manual attributes.

Supported outcomes include:

UTF-8 CSV download;
CSV email;
MISP submission;
MISP plus CSV download;
MISP plus CSV email.

Rejected staging attributes remain recorded for audit. Submitted batches retain resulting MISP event and attribute identifiers before leaving the active queue.

For combined MISP-and-email processing, event creation occurs first and email delivery follows. This preserves the MISP result when email delivery requires a later retry.

34. How is Behavioral Intelligence developed?¶

Copying an article to Behavioral Intelligence carries forward:

article summary;
behavior steps;
detection notes;
tags;
source links;
source article identity.

Behavioral enrichment runs every 15 minutes and can discover cited or related:

Sigma;
Splunk;
Suricata and Snort;
Zeek;
YARA material.

Detection candidates retain their family, title, source, rule or query text, evidence, candidate status and analyst drafts.

Analysts can edit candidates, save versioned drafts, designate a final candidate and remove drafts. Marking a candidate final preserves the selected text, family, title, source and final status as a curated detection-development artifact.

35. How is approved intelligence made available to Splunk?¶

Splunk publication uses a separately approved snapshot of a workbench batch.

The snapshot contains:

reviewed indicators;
tags;
TLP;
source reference;
modification time;
approval metadata.

A content hash binds approval to the reviewed version. Editing a previously approved batch changes the hash and requires publication approval again.

Approved snapshots are served through a separately authenticated machine interface. Browser authentication for analysts, analyst approval of intelligence and machine authentication for Splunk remain distinct controls.

36. How are tag-driven hunts populated?¶

Analysts define a hunt using selected MISP tags.

A rebuild:

Clears the hunt's previous cached indicators.
Queries MISP events carrying the selected tags.
Normalizes matching attributes.
Repopulates the hunt indicator set.

This allows reviewed intelligence to flow through indicator staging, MISP publication, tag assignment, hunt rebuilding and operational hunt population.

37. How are intel2pcap recommendations selected?¶

A separate hourly process searches for material suitable for simulated traffic and network-detection development.

Initial candidate gates include:

active article state;
usable article text;
Network Actionability of at least 60;
Financial Sector Relevance of at least 55 when financial routing is active;
current profile version;
active network-review state;
available send eligibility.

Candidates are ordered by:

Network Actionability.
AI confidence.
Publication time.
Stable article identity.

Up to 20 candidates enter a second structured review. The review records:

send, hold, reject or human-review disposition;
worthiness score;
best source;
network-detection angle;
TLS and observability caveats.

A candidate proceeds when the review recommends sending or assigns a worthiness score of at least 65 with a compatible disposition.

Delivery is rate-limited to a default maximum of six recommendations per day and at least four hours between sends.

The recommendation contains:

article identity and source;
Network Actionability;
Financial Sector Relevance;
reason for selection;
proposed PCAP scenario;
expected observable behavior;
TLS and logging caveats;
a safe intel2pcap prompt;
a link back to the analyst interface.

The recommendation creates a human quality-control step before traffic generation or detection implementation.

38. How are failures retried?¶

Progress is driven by persisted state:

feed failures are attempted during the next hourly collection;
blank article bodies remain eligible for text repair;
unscored articles remain eligible for Network Actionability scoring;
missing current-version profile scores remain eligible for relevance scoring;
unreviewed articles remain eligible for Detection Opportunity review;
source discovery retains a specific outcome;
failed workbench batches remain available for correction;
identical successful structured reviews can be reused from cache;
soft-deleted and folded records remain available for audit and recovery.

Each article advances independently. A temporary failure involving one publisher, candidate source, model request or publication destination therefore has a bounded effect and leaves enough state for continuation.

39. How does the complete funnel filter time-wasters?¶

An article earns increasingly expensive processing and analyst attention by passing a sequence of decisions:

It originates from an intentionally selected security source.
It was published or updated during the previous 24 hours.
Its title carries acceptable intelligence value.
Strong CVE, malware, ransomware, exploitation or APT evidence overrides broad title exclusions.
The page yields enough genuine article content.
Extraction quality distinguishes technical reporting from access pages and page furniture.
Repeated actor and malware references support deterministic tags.
Wrapper-like reporting triggers a search for richer original research.
Candidate sources are ranked by citation context, source quality, title relationship and technical depth.
Automatic source replacement requires a score of at least 85, at least 400 words and a substantial content improvement.
Network Actionability rewards protocols, observables, packet evidence and behavior chains.
Marketing language, routine product updates, thin observables and unknown delivery details receive substantial penalties.
Financial Sector Relevance independently measures mission alignment through five weighted groups.
Detection Opportunity independently measures multi-telemetry detection potential through five explicit dimensions.
Low network scores move toward soft deletion after repair and review opportunities.
Network holds preserve articles with broader detection potential while routing them away from network-specialized outputs.
Duplicate CVE, indicator and source relationships fold multiple reports toward a stronger canonical representative.
High Value Results requires Network Actionability of at least 90.
Indicator validation removes publisher infrastructure, reserved addresses, common noise and article artifacts.
Human review controls workbench, MISP, CSV and downstream intelligence publication.
intel2pcap applies an additional structured review and rate limit before contacting an analyst.

The resulting lifecycle begins with fresh curated reporting, replaces summaries with stronger evidence where possible, scores technical utility separately from organizational relevance, preserves multi-telemetry opportunities, consolidates duplication and reserves analyst time for material with clear operational value.