Skip to main content

CTI Project Ecosystem

Purpose

This page connects the three CTI documentation projects into one practitioner ecosystem. Each project has a different role, but they are intended to be used together.

The Ecosystem

ProjectRoleUse When You Need
CTI Analyst Field ManualGeneral CTI tradecraft and analyst operating manualEvidence discipline, analytic judgment, attribution, infrastructure pivoting, actor research workflow, CTI-to-detection foundations, templates
Customer-Driven AI CTI ProjectDelivery methodology and customer engagement operating modelProject phases, quality gates, customer outcomes, AI-assisted workflow controls, acceptance criteria, replay and delivery packages
Israel Government Threat Actors CTISector and actor knowledge baseIsraeli public-sector threat model, actors, tools, TTPs, detections, hunts, evidence registers, source tracking
HexStrike AIAI-powered offensive security automation platformMCP agent-based tool orchestration, 150+ security tools, AI-driven penetration testing, adversarial validation of detection coverage
  1. Start here when you need the tradecraft standard: CTI Analyst Field Manual.
  2. Move to the delivery model when work must become a managed customer project: Customer-Driven AI CTI Project.
  3. Use the Israel-focused knowledge base when the question involves Israeli government, municipal, telecom, critical-infrastructure, or supplier exposure: Israel Government Threat Actors CTI.

Cross-Project Workflows

Actor Profile to Customer Delivery

Use Actor Research to structure the profile, then use Customer-Driven AI CTI Project to turn it into a project plan, quality gates, and accepted deliverables. Use Israel Government Threat Actors CTI when the actor requires Israel-sector context.

CTI Finding to Detection Backlog

Use Intelligence to Detection for the reasoning chain. Use Customer-Driven AI CTI Project for phase control and gate evidence. Use Israel Government Threat Actors CTI for concrete actor, tool, TTP, hunt, and detection examples.

Source Claim to Evidence Register

Use Evidence Labels and Source Reliability as the analytic standard. Use the Customer project for delivery gates. Use the Israel project for a live example of source and evidence governance.

Boundary

The CTI documentation projects (Field Manual, Customer project, Israel CTI) are defensive and public-source oriented. They do not provide exploit instructions, malware source code, leaked data, credentials, or unauthorized-access guidance. HexStrike AI is an authorized offensive security and penetration testing platform; use it only in authorized engagements.