{"description":"Runs on the existing Process item \"Threat Intelligence & Insider Threat Program\" (process_type=security_process, process_owner = program lead) — a long-lived program record related to the Control items it operates (UC-RISK-17, UC-BCDR-16, UC-GOV-37); each cycle is one recurring workflow instance attached to that Process, enriching the standing program rather than creating a new one. Decision-aware, covering NIST SP 800-53 PM-12, PM-16, and RA-10 and NIST CSF 2.0 ID.RA and DE.CM. In scope: cyclic intake and curation of threat intelligence into a validated intake register and intel cards, governed internal dissemination and TLP-marked outbound sharing packages, intel-driven threat hunts (producing the hunt summary) and any resulting investigation record, and privacy-guarded review of insider-threat indicators with a governed board disposition and a restricted insider case file, closing with a program-effectiveness report and a reperformable cycle archive. No upstream workflow feeds it; the only cross-run input is the prior cycle's carry-forward package (the carry-forward document from the previous instance's program-effectiveness report step, which closes each cycle), and each cycle emits the next one. Out of scope and handed off only in prose (no terminal handoff node): incident-response execution (the incident-response process, once an incident is declared at open-investigation) and HR/legal employment actions (owned by those functions within an insider case). Each cycle's intel-and-hunt track and its insider-threat track start in parallel from their own inputs.","edges":[{"id":"e-ingest-and-curate-intelligence-disseminate-and-share","source":"ingest-and-curate-intelligence","target":"disseminate-and-share"},{"id":"e-ingest-and-curate-intelligence-run-hunt-cycle","source":"ingest-and-curate-intelligence","target":"run-hunt-cycle"},{"id":"e-run-hunt-cycle-open-investigation","label":"Suspicious","source":"run-hunt-cycle","target":"open-investigation","whenValue":"suspicious_activity"},{"id":"e-run-hunt-cycle-report-program-effectiveness","label":"No findings","source":"run-hunt-cycle","target":"report-program-effectiveness","whenValue":"no_findings"},{"id":"e-open-investigation-report-program-effectiveness","source":"open-investigation","target":"report-program-effectiveness"},{"id":"e-review-insider-threat-indicators-coordinate-insider-case","label":"Case opened","source":"review-insider-threat-indicators","target":"coordinate-insider-case","whenValue":"case_opened"},{"id":"e-review-insider-threat-indicators-report-program-effectiveness","label":"No action","source":"review-insider-threat-indicators","target":"report-program-effectiveness","whenValue":"no_action"},{"id":"e-coordinate-insider-case-report-program-effectiveness","source":"coordinate-insider-case","target":"report-program-effectiveness"},{"id":"e-disseminate-and-share-report-program-effectiveness","source":"disseminate-and-share","target":"report-program-effectiveness"}],"isPublic":true,"metadata":{"capabilities":[],"controlVerbs":{},"controls":["UC-RISK-17","UC-BCDR-16","UC-GOV-37"],"department":"it","domains":["controls"],"library":{"aliases":[],"canonicalUrl":"https://workflow-library.com/all/?w=controls-threat-intelligence-program","contentDigest":"sha256:9e50ff9e802446081a3b33b6195cb72fc672500d02b83389a22727d7e12d9ece","prerequisites":{"status":"undeclared"},"provenance":[],"releaseId":"sha256:9e50ff9e802446081a3b33b6195cb72fc672500d02b83389a22727d7e12d9ece","schemaVersion":1,"sourceTemplateId":"workflow-library:controls-threat-intelligence-program"},"lineOfDefense":"operate","mappingStatus":"mapped","risks":[],"slug":"controls-threat-intelligence-program","source":"coworkcanvas-gallery","standards":["nist-800-53","nist-csf-2"],"teams":["it"]},"name":"Threat Intelligence & Insider Threat Program","nodes":[{"data":{"description":"Agent ingests feeds and ISAC advisories, dedupes and scores relevance to the environment, and drafts actionable intel cards; human validates the relevance calls","instructions":"**Objective** — Turn this cycle's raw threat feeds into a validated set of environment-relevant, actionable intel cards that downstream sharing and hunting can consume.\n\n**Inputs**\n- The intelligence source register for the cycle — subscribed commercial and open feeds, ISAC and sharing-community memberships, vendor advisories, and internal telemetry sources, with feed health and any lapsed subscription noted — uploaded as an XLSX/CSV document (PBC) on this step. AssureSwarm has no native item type for intel sources, so the register is a step document, not queryable items. This register is one of the workflow's own starting inputs; there is no upstream workflow that supplies it.\n- The prior cycle's carry-forward package: the carry-forward document attached to the previous cycle instance's report-program-effectiveness step — the step that closes each cycle — listing the carried hunt backlog, unexpired intel actions, and active cases. This is the only cross-run handoff.\n- The environment profile used for relevance scoring: the standing process inventory is the existing Process items related to the anchor; the technology-stack/asset inventory and detection/telemetry coverage map are uploaded as a document on this step (AssureSwarm has no Asset type); the live indicator-vs-telemetry match is pulled via query-data against the SIEM (external system) with results saved as a document on this step.\n\n**Procedure**\n1. Ingest every feed item, ISAC advisory, vendor bulletin, and internal report received since the last cycle. Record source, TLP marking, and receipt timestamp per item — the receipt timestamp is the clock for the mean-time-to-action metric computed later.\n2. Deduplicate overlapping reporting and normalize the content into one intake register: indicators (hashes, IPs, domains), adversary techniques mapped to MITRE ATT&CK technique IDs, and threat-actor or campaign references.\n3. Score each item for relevance to THIS environment on four axes — technology-stack match, sector targeting, geographic exposure, and whether referenced indicators already appear in current telemetry. Use high/medium/low, and auto-promote any item whose indicators already match live telemetry to high.\n4. For each relevant item, draft an actionable intel card stating: the threat, why it applies here, the recommended action (new detection content, a hunt hypothesis, or a control change), the affected asset groups, the ATT&CK techniques, and an expiry date after which the card is re-validated or retired.\n5. For down-scored items, record the reason for the low-relevance call so the discard list is auditable — analysts must be able to challenge a wrongful discard.\n\n**Record in AssureSwarm**\n- Step document: the intake register plus one intel card per relevant item, as an XLSX workpaper attached to this step (columns: relevance score, ATT&CK technique IDs, recommended action, affected asset groups, expiry date), with the auditable discard list and its low-relevance reasons in the same register — AssureSwarm has no Intel Card item type, so the cards live as a step document, not queryable items (document-upload).\n- Item create — Risk: where an intel card reveals a durable exposure rather than a one-off, create a Risk item (category: cyber_security, taxonomies: cyber_security), related to the anchor Process, so the exposure enters the register instead of living only in the intel document (item-create).\n- Step document: the source bulletins and advisories attached as evidence, and the telemetry/SIEM indicator-match results from the relevance axis saved as a document on this step (query-data, document-upload).\n\n**Exit criteria** — Every ingested item is deduped and either carded or on the discard list with a reason; each intel card names a recommended action, ATT&CK mapping, affected assets, and an expiry; a human has reviewed the relevance scores and discard list and approved the curated set for dissemination and hunting.","label":"Ingest and curate intelligence","performedBy":{"primitives":["coach-query-data","coach-item-create","coach-document-upload"]}},"id":"ingest-and-curate-intelligence"},{"data":{"description":"Agent routes intel cards to internal owners and stages outbound sharing packages per TLP markings; human approves all outbound sharing","instructions":"**Objective** — Route each approved intel card to the internal owners who must act on it and stage TLP-compliant outbound packages for sharing communities, with a human approving every outbound disclosure before release.\n\n**Inputs**\n- The approved intel cards from the intelligence-curation step (the intake-register/intel-card document on that step), each with its recommended action and affected asset groups.\n- The sharing obligations and TLP handling rules for each community, and the disclosure approval chain — held as a Policy item (policy_type: procedure, policy_owner, framework, next_review_date) with its governed document attached; referenced here as an existing input.\n- The internal action-owner map: control owners are read from Control.control_owner on the related Control items; the broader routing map (detection engineering, vulnerability management, leadership) is uploaded as a document on this step.\n\n**Procedure**\n1. Route each approved card to its internal audience by recommended action: detection engineering for content changes, vulnerability management for exposure checks, control owners for configuration actions, leadership for strategic items. Record delivery and acknowledgment per recipient.\n2. Convert each card's recommended action into a tracked item with a named owner and due date, so intel utilization (issued vs. acted-on) is measurable at reporting time.\n3. For each sharing community, assemble the outbound package: sanitize internal identifiers (asset names, account names, case references), then verify the TLP marking on EVERY included item permits redistribution to that specific audience — TLP:RED never leaves the originating parties, TLP:AMBER stays within the community on a need-to-know basis.\n4. Draft each submission in the receiving community's expected format and stage the outbound queue with a per-package summary: what is disclosed, the receiving community, and the marking applied.\n5. Hold the queue for human release — do not auto-send. Nothing that could reveal an open investigation may sit in a package.\n\n**Record in AssureSwarm**\n- Item create — Issue: one Issue per card's recommended action (issue_type: opportunity or observation, source: management_identified, issue_owner, target_remediation_date; actual_remediation_date set at closure) so intel utilization — issued vs. acted-on — is measurable at reporting time (item-create).\n- Item relationship: link each action Issue to the Control item it changes and to the anchor Process, and link the delivered internal recipients' acknowledgment records as documents (items-link, document-link).\n- Step document: each approved TLP-marked outbound sharing package exported as a per-community file (ZIP/CSV in that community's expected format) attached to this step with its TLP/sanitization summary; the human release approval is recorded on the step and the actual transmission to the ISAC/community is an external system (item-export).\n\n**Exit criteria** — Every card has a tracked internal action item with owner and due date; each staged outbound package has verified sanitization and a TLP marking compatible with its audience; a human has approved and released the outbound packages, returning any that failed the sanitization or marking check for rework.\n\n> **⚡ Audit Artist accelerator:** `/coach-notify` routes each card to its internal owners and records acknowledgments; `/coach-redact` strips internal identifiers from an outbound package before the human sanitization review.","label":"Disseminate and share","performedBy":{"primitives":["coach-item-create","coach-items-link","coach-document-upload","coach-export-package","coach-notify","coach-redact"]}},"id":"disseminate-and-share"},{"data":{"decisionField":"hunt_result","description":"Agent translates prioritized intel into hunt queries and executes them across telemetry, compiling hits with context; human analyst adjudicates the results","formData":{"fields":[{"key":"hunt_result","label":"Run hunt cycle","options":[{"label":"No suspicious findings","value":"no_findings"},{"label":"Suspicious activity found","value":"suspicious_activity"}],"required":true,"type":"select"}],"resultType":"form","submittedAt":null,"values":{}},"instructions":"**Objective** — Resolve whether this cycle's intel-driven hunts surfaced credible malicious or unauthorized activity, so the workflow either opens an investigation or records a clean hunt. Owned by the hunt-adjudicating analyst. Before the decision, the agent runs the hunt autonomously: (1) select the top hunt hypotheses from the approved intel cards and the carried backlog, stating for each the threat behavior sought, the ATT&CK techniques covered, and the telemetry sources required; (2) translate each hypothesis into concrete hunt queries across endpoint, network, identity, and cloud telemetry, validating data availability and time-range coverage before execution; (3) execute the hunts, recording query text, execution window, and data coverage per hunt, and note any hypothesis that could not run for coverage reasons; (4) compile every hit with surrounding context — asset criticality, account involved, related alerts — and a benign-versus-suspicious first-pass assessment with the evidence behind each call; (5) draft the hunt summary listing hypotheses run, coverage achieved, hits by disposition, and detection-content gaps discovered along the way.\n\n**Decision criteria**\n- `suspicious_activity` (Suspicious activity found): at least one hit credibly indicates malicious or unauthorized activity after the analyst weighs it against its evidence — for example a confirmed ATT&CK technique execution on a real asset, anomalous privileged access matching the hunted behavior, or indicator matches not explained by any sanctioned activity. Pick this if even one hit clears the bar; volume is not required.\n- `no_findings` (No suspicious findings): every hit resolves to benign or explained on review, or the hunts ran with adequate coverage and returned nothing. Detection-content gaps found along the way are recorded regardless but do not by themselves make the result suspicious.\n\n**Record in AssureSwarm**\n- Step form: submit the `hunt_result` SELECT with the chosen branch. In the step result, cite the specific hunt and hit identifiers behind the call and why each suspicious candidate was or was not escalated; set the step's approver record to the adjudicating analyst.\n- Step document: attach the hunt summary as an XLSX workpaper on this step — hypotheses run, query text and execution window, telemetry coverage achieved, hits by disposition, and detection-content gaps discovered — with the query/coverage log (query-data, document-upload).\n- Item create — Issue: for each detection-content gap worth tracking to closure, create an Issue (issue_type: observation, source: internal_audit, issue_owner, target_remediation_date) and link it to the affected Control item (item-create, items-link).\n\n**Exit criteria** — `hunt_result` is submitted with an evidence-referenced rationale; the hunt summary is attached; the unused branch is prunable.","kind":"decision","label":"Run hunt cycle","performedBy":{"primitives":["coach-query-data","coach-document-upload","coach-item-create","coach-items-link"]}},"id":"run-hunt-cycle"},{"data":{"description":"Agent packages the hunt evidence and opens the investigation record with candidate containment options; human leads the investigation","instructions":"**Objective** — Stand up a traceable investigation record from the hunt's suspicious hits with candidate containment options, so a human responder can run it to a decision without re-gathering evidence.\n\n**Inputs**\n- The adjudicated suspicious hits from the hunt decision, with their evidence and rationale.\n- The originating intel card(s) and hunt queries, for lineage.\n- The severity proposed by the adjudicating analyst.\n\n**Procedure**\n1. Package the evidence per suspicious hit: query results, a timeline of the observed activity, affected assets and accounts, and the intel card that motivated the hunt.\n2. Open the investigation record referencing the evidence package, assign the analyst-proposed severity, and link it to the originating hunt and intel items so lineage is traceable end to end.\n3. Draft candidate containment and escalation options with the operational impact of each — for example isolate host, monitor-in-place, or disable account — for the responder to weigh. Do NOT execute any of them; the agent proposes, the human disposes.\n4. Track investigation tasks and keep the record current as the human team works: findings, scope changes, and any handoff to the incident-response process once an incident is declared.\n\n**Record in AssureSwarm**\n- Item create — Audit: open the investigation as an Audit item (audit_type: investigation, lead_auditor = the responder, the analyst-proposed severity noted in `description` since Audit has no severity field) (item-create).\n- Item relationship: link the Audit to the anchor Process, the affected Control items, and the originating hunt/intel register so lineage is traceable end to end (items-link).\n- Step document: attach the evidence package and the candidate containment-and-escalation-options memo to this step (document-upload).\n- Item create — Issue: where the investigation confirms malicious or unauthorized activity, create Issue item(s) (issue_type: finding, source: internal_audit, issue_owner) linked to the Audit.\n- Handoff package (prose): if an incident is declared, attach the incident-response handoff package as a document on this step for the incident-response workflow (out of scope here) to consume — no terminal handoff node models this, so the cross-workflow handoff stays in prose.\n\n**Exit criteria** — Investigation record open with evidence attached and lineage links to hunt and intel; containment options drafted with none executed; a human has validated the evidence, decided containment and escalation, declared or ruled out an incident, and recorded the outcome plus any new detection content or intel produced.","label":"Open investigation","performedBy":{"primitives":["coach-item-create","coach-document-upload","coach-items-link"]}},"id":"open-investigation"},{"data":{"decisionField":"insider_review","description":"Agent aggregates policy-violation and anomaly indicators under privacy guardrails; human insider-threat board decides the response","formData":{"fields":[{"key":"insider_review","label":"Review insider-threat indicators","options":[{"label":"No action required","value":"no_action"},{"label":"Insider case opened","value":"case_opened"}],"required":true,"type":"select"}],"resultType":"form","submittedAt":null,"values":{}},"instructions":"**Objective** — Decide, per subject, whether aggregated insider-threat indicators warrant opening a formal case. Owned by the insider-threat board (security with HR and legal present). This track starts in parallel from its own inputs and does not depend on the intel or hunt tracks. Before the decision, the agent prepares the review autonomously under privacy guardrails: (1) aggregate the cycle's insider inputs — referrals from HR, legal, and managers, policy-violation alerts, data-movement anomalies, and access-pattern outliers from monitoring; (2) apply the documented privacy guardrails — role-based pseudonyms instead of names in working material, detail restricted to the need-to-know reviewer group, and every access to the review file logged; (3) correlate indicators per subject and score them against the insider-risk criteria (data-exfiltration signals, sabotage precursors, repeated policy violations, and HR-supplied contextual factors), separating a single benign anomaly from a converging pattern; (4) draft a board briefing for each subject over threshold — indicator timeline, score with its basis, prior history where policy permits, and a recommended disposition; (5) schedule the board session and distribute the briefings to board members only.\n\n**Decision criteria**\n- `case_opened` (Insider case opened): a subject's indicators converge into a credible pattern that meets the insider-risk threshold — for example data-exfiltration signals plus a corroborating HR context, or repeated policy violations escalating in severity — and the board judges a formal, evidence-preserving case is warranted and proportionate.\n- `no_action` (No action required): indicators are isolated, explained, or below threshold; the board records the review and closes with no case. Proportionality and employee-rights obligations weigh here — do not open a case on a single unexplained anomaly.\n\n**Record in AssureSwarm**\n- Submit `case_opened` if the board approved at least one case; otherwise submit `no_action`. Preserve every per-subject disposition and carry only the approved subjects into the case checkpoint.\n- In the step result, record the per-subject disposition, the board members present, and the evidence weighed (using pseudonyms); set the step's approver record to the board chair.\n\n**Exit criteria** — `insider_review` is submitted with a rationale naming the board members and per-subject disposition; privacy guardrails intact (no cleartext names in shared material); the unused branch is prunable.\n\n> **⚡ Audit Artist accelerator:** `/coach-redact` applies the role-based pseudonyms and need-to-know scoping to the board briefings before distribution.","kind":"decision","label":"Review insider-threat indicators","performedBy":{"primitives":["coach-query-data","coach-document-upload","coach-redact"]}},"id":"review-insider-threat-indicators"},{"data":{"description":"Agent maintains the restricted case file and tracks agreed actions with HR and legal; humans run the case and decide outcomes","instructions":"**Objective** — Run the approved insider case to a governed outcome, maintaining a restricted, chain-of-custody-grade case file while HR and legal own all subject interaction.\n\n**Inputs**\n- The board decision, briefing, and minutes from the insider-threat review (case_opened branch).\n- The named case team (security, HR, legal) and their agreed case plan.\n- Case-scoped telemetry access for risk-profile monitoring.\n\n**Procedure**\n1. Open the formal case file with the briefing, board minutes, and disposition. AssureSwarm has no field-level access restriction, so the case cannot be locked to the named case team inside AssureSwarm: keep all insider material pseudonymized in every stored document, and where a truly restricted file is required, hold it in the External system with only a redacted copy retained in AssureSwarm as evidence.\n2. Track the agreed monitoring adjustments, interviews, access reviews and administrative actions as entries in the restricted case workpaper, with an owner, date and approval reference for each. Keep their progress in this case checkpoint rather than creating a workflow node per action. Require the appropriate human approval before each action runs and retain HR/legal ownership of subject interactions.\n3. Maintain the evidence log with chain-of-custody detail (who collected what, when, and from where) so any eventual administrative or legal proceeding can rely on it.\n4. Watch case-scoped telemetry for changes in the subject's risk profile and alert the case lead to material changes — take no action independently.\n5. Prepare the case-closure summary: outcome, actions taken, and lessons feeding back into the insider-risk detection criteria.\n\n**Record in AssureSwarm**\n- Item create — Audit: open the insider case as an Audit item (audit_type: investigation, lead_auditor = the case lead) and link it to the board decision and evidence (item-create, items-link).\n- Step document: attach the case file, chain-of-custody evidence log, board minutes, and closure summary to this step, kept pseudonymized — AssureSwarm has no field-level access restriction, so no stored document may carry cleartext subject names, and the true restricted file, if one is required, stays in the External system with only a redacted copy here as evidence (document-upload).\n- Scan case-scoped workflow and telemetry for risk-profile changes (workflow-scan).\n\n**Exit criteria** — Case file complete and kept pseudonymized (AssureSwarm has no field-level access restriction — no cleartext subject names in any stored document, restricted material held External with a redacted AssureSwarm copy); every case-plan step owner-assigned and human-approved before execution; evidence-log chain of custody intact; final outcome decided by HR, legal, and security, and the closure summary confirmed complete before the case leaves the cycle.","label":"Coordinate insider case","performedBy":{"primitives":["coach-item-create","coach-items-link","coach-document-upload","coach-workflow-scan"]}},"id":"coordinate-insider-case"},{"data":{"description":"Agent compiles intel utilization, hunt coverage and case metrics into the program report, then archives the cycle evidence and prepares the carry-forward package; human approves distribution, which closes the cycle","instructions":"**Objective** — Produce the cycle's program-effectiveness report and audience-tailored distribution packages from the intel, hunt, investigation, and insider-case registers, then bring every cycle artifact to a terminal, archived, reperformable state — the approval of distribution recorded here is the cycle's closure.\n\n**Inputs**\n- The intel-curation and dissemination registers: cards issued, internal action items, and outbound packages shared.\n- The hunt summary and any investigation records opened this cycle.\n- The insider-threat review dispositions and any coordinated-case metrics.\n- The remaining cycle artifacts to be brought terminal and archived: intake register, intel cards, sharing approvals, hunt queries, board minutes, restricted case files, and decision rationales.\n- The retention location and its access controls, and the recurring schedule for the next cycle window.\n\n**Procedure**\n*The report’s distribution approval authorizes subsequent archive and next-cycle scheduling; those records add no confirmation.*\n\n1. Compute cycle metrics directly from the registers with no manual adjustment: intel cards issued and acted on, action closure rate, outbound packages shared, hunt hypotheses run vs. backlog, telemetry coverage achieved, hits adjudicated by disposition, investigations opened, and insider referrals reviewed with board dispositions.\n2. Build trend views versus prior cycles: intel utilization, mean time from advisory receipt to action, hunt coverage of priority ATT&CK techniques, and insider-case cycle time; flag any deteriorating trend.\n3. Draft the effectiveness report highlighting detection-content gaps found by hunting, feed sources that produced no actionable intel (candidates to drop or renegotiate), and proposed next-cycle improvements with suggested owners.\n4. Prepare distribution packages per audience: full detail for security leadership, and a privacy-safe AGGREGATE summary for the broader governance forum in which no insider-threat subject is identifiable.\n5. Verify every artifact is terminal: intel cards actioned or expired, outbound packages released or withdrawn, hunts concluded with adjudication recorded, investigations closed or handed to incident response, and insider cases closed or formally carried forward with an owner.\n6. Archive the full evidence set to the retention location — sufficient for an independent assessor to reperform this cycle's decisions from evidence alone — keeping restricted case material under its access controls.\n7. Compile the carry-forward package: open hunt hypotheses, unexpired intel actions, active cases, and feed or sharing changes proposed for the next cycle's intake. It is this cycle's only handoff — the next instance reads it as its cross-run input.\n8. Update the recurring schedule with the next cycle window and record the closure timestamp and archive references alongside the distribution approval.\n\n**Record in AssureSwarm**\n- Build the metrics dashboard (dashboard-create) and query the registers for the figures (query-data).\n- Export the tailored report packages (item-export).\n- Export the archived cycle package (workflow-export) and upload the retention bundle and carry-forward package (document-upload).\n\n**Exit criteria** — Report figures tie to the registers; trend flags applied; the governance copy verified to contain no subject-identifiable insider content; improvement actions have named owners; nothing is left in an ambiguous state; restricted material is archived with access controls intact; the carry-forward package is complete and the closure timestamp and next-cycle window are recorded; a human has reviewed accuracy and framing and approved distribution, and that approval closes the cycle.\n\n> **⚡ Audit Artist accelerator:** `/coach-render-package` assembles the per-audience report packages from the metrics dashboard and register exports.","label":"Report program effectiveness","performedBy":{"primitives":["coach-query-data","coach-dashboard-create","coach-export-package","coach-render-package","coach-workflow-export","coach-document-upload"]}},"id":"report-program-effectiveness"}],"sourceTemplateId":"workflow-library:controls-threat-intelligence-program"}