A curated collection of Cyber Threat Intelligence (CTI) reference documents designed to help analysts, SOC teams, and vulnerability managers strengthen their understanding of modern triage, scoring, and prioritization workflows. This repository serves as a centralized knowledge base for high‑value, analyst‑ready material that simplifies complex security concepts into practical guidance.
A comprehensive reference covering:
- CVSS v3.1 Base, Temporal, and Environmental scoring
- Exploitability and impact metrics
- How to interpret CVSS vector strings
- KEV prioritization rules
- EPSS automation signals
- CISA BOD 26‑04 remediation tiers and SLAs
- Combined triage decision matrices (KEV + EPSS + CVSS + asset exposure)
Example excerpt:
“CVSS scores range 0.0–10.0. Severity ratings guide initial prioritization but must be combined with KEV and EPSS signals for accurate triage.”
The Learning‑Material repository provides accessible, structured CTI knowledge that supports:
- Vulnerability triage
- Threat‑driven prioritization
- Analyst skill development
- CTI workflow design
- Modern remediation decision‑making
As the repository grows, additional resources may include ATT&CK mapping references, enrichment workflow guides, triage playbooks, and CTI methodology notes.
This repository is designed for:
- CTI Analysts
- SOC Analysts
- Vulnerability Managers
- Security Engineers
- Anyone learning modern CTI practices
Planned enhancements include:
- Additional cheat sheets
- CTI workflow diagrams
- Enrichment methodology notes
- ATT&CK technique references
- Triage playbooks
- CTI pipeline architecture documentation
If you have feedback, ideas, or want to collaborate on CTI visualization or enrichment workflows, feel free to open an issue or submit a pull request.