{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:9e50ff9e802446081a3b33b6195cb72fc672500d02b83389a22727d7e12d9ece","slug":"controls-threat-intelligence-program","url":"/assets/agent_workflow-controls-threat-intelligence-program-2709f685.43deef81a22b282b.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-threat-intelligence-program","description":"Runs on the existing Process item \"Threat Intelligence & Insider Threat Program\" (process_type=security_process, process_owner = program lead) — a long-lived program record related to the Control items it operates (UC-RISK-17, UC-BCDR-16, UC-GOV-37); each cycle is one recurring workflow instance attached to that Process, enriching the standing program rather than creating a new one. Decision-aware, covering NIST SP 800-53 PM-12, PM-16, and RA-10 and NIST CSF 2.0 ID.RA and DE.CM. In scope: cyclic intake and curation of threat intelligence into a validated intake register and intel cards, governed internal dissemination and TLP-marked outbound sharing packages, intel-driven threat hunts (producing the hunt summary) and any resulting investigation record, and privacy-guarded review of insider-threat indicators with a governed board disposition and a restricted insider case file, closing with a program-effectiveness report and a reperformable cycle archive. No upstream workflow feeds it; the only cross-run input is the prior cycle's carry-forward package (the carry-forward document from the previous instance's program-effectiveness report step, which closes each cycle), and each cycle emits the next one. Out of scope and handed off only in prose (no terminal handoff node): incident-response execution (the incident-response process, once an incident is declared at open-investigation) and HR/legal employment actions (owned by those functions within an insider case). Each cycle's intel-and-hunt track and its insider-threat track start in parallel from their own inputs.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-threat-intelligence-program","capabilities":[],"controls":["UC-RISK-17","UC-BCDR-16","UC-GOV-37"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:9e50ff9e802446081a3b33b6195cb72fc672500d02b83389a22727d7e12d9ece","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-threat-intelligence-program","standards":["nist-800-53","nist-csf-2"],"teams":["it"]},"id":"wf:C20","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC20","slug":"controls-threat-intelligence-program","sourceIds":["dora","iso-27001","nist-800-53"],"sourceUrl":null,"title":"Threat Intelligence & Insider Threat Program","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb972e44256aca18fe9a60427a0533c7f591e59d850fe3210c3a5632e2ae8e70","properties":{},"sourceDetailPath":"/data/v1/records/wf-c20-5b99e185.json","sourceId":"wf:C20","targetDetailPath":"/data/v1/records/uc-uc-gov-37-8fd5a91b.json","targetId":"uc:UC-GOV-37","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d07b8d4ff9f3bb16068b3bf85756957731ab8d0a0683e2c7e53d3320d980e07c","properties":{},"sourceDetailPath":"/data/v1/records/wf-c20-5b99e185.json","sourceId":"wf:C20","targetDetailPath":"/data/v1/records/uc-uc-risk-17-4ea73b39.json","targetId":"uc:UC-RISK-17","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f4d07480aabe1493dc9b848172945bf621c47b3b1dab36fc4f82036e2e06e7c9","properties":{},"sourceDetailPath":"/data/v1/records/wf-c20-5b99e185.json","sourceId":"wf:C20","targetDetailPath":"/data/v1/records/uc-uc-bcdr-16-462251f1.json","targetId":"uc:UC-BCDR-16","type":"operates"}],"schemaVersion":1}