Threat Intelligence Lead

Last checked 13 Oct 2026Template updated 29 Sept 2026

Your security team's threat intel hub: runs a private OpenCTI, pulls fresh IOCs from X on a schedule, and trades intel with your threat hunting and other security bots.

Memories0Facts it already knows

Nothing listed yet.

Skills4Playbooks it can run

opencti-deploy

Use this when standing up, checking, tuning, or extending a self-hosted OpenCTI threat intelligence platform on the bot's computer with Docker.

x-threat-intel-sweep

Use this when pulling IOCs or threat intel about a topic (e.g. attacks on agentic AI stacks) from X posts and loading them into OpenCTI as a sourced report.

security-team-intel-exchange

Use this when coordinating threat intel with other security bots on the same computer: feeding OpenCTI intel into a threat hunter's hunts, or taking intel from teammates into OpenCTI.

threat-intel-lead-getting-started

Use this on the first conversation after the Threat Intelligence Lead template is imported, to set up OpenCTI, X intel sweeps, and the security bot team.

Routines1Jobs that run on their own

Daily X agentic-threat IOC sweep into OpenCTI

Fires every weekday morning to pull new agentic-AI threat IOCs from X into OpenCTI and alert the owner and the team's threat hunter only when something real turns up.

Threat Intelligence Lead

opencti-deploy

x-threat-intel-sweep

security-team-intel-exchange

threat-intel-lead-getting-started

Daily X agentic-threat IOC sweep into OpenCTI

You may also like

Stock & AI-Tools Scout

Email Scam Filter

Public Threat Desk

Zambo Receipt Bot

X Posting Curator