Threat intelligence arrives as reports, feeds, indicators and updates. The difficult work is deciding which records describe the same subject, what has materially changed and which change matters to your environment. A longer queue does not answer those questions.

Threat Foundry brings that work into Unified CTI ML: connected source evidence, versioned assessments and task-specific machine learning. The result is an intelligence workflow that can learn from permitted analyst decisions while keeping the source and reasoning available for review.

Unify the assessment, preserve the sources

Several sources may discuss one vulnerability, threat or technique. Some add independent observations; others repeat an earlier report. Analysts need a coherent assessment without losing the distinction between those contributions.

Unified Intake associates eligible evidence with an intelligence subject and retains source revisions, publication and observation times, permissions and review decisions. Accepted, provisional, related and rejected associations remain meaningful states. A familiar identifier or similar title is a starting point for review, not automatic proof that two reports concern the same subject.

This context makes the next decision more useful: does the new evidence reinforce an existing assessment, change it materially or belong elsewhere?

Four learning tasks, four practical questions

Unified CTI ML separates questions that would be obscured by a single general-purpose score:

  • Subject association: does this specific evidence belong with this intelligence subject, concern a related subject or remain separate?
  • Material change: does the latest evidence alter the reviewed assessment, or largely repeat information already considered?
  • Relevance: does the assessment matter to the tenant and its available business, asset and threat context?
  • Actionability: does it justify hunting, detection, exposure review or investigation, or is monitoring still appropriate?

These models can consider context such as evidence age, source lineage, reposting, product and version compatibility, telemetry availability and the changes between assessment revisions. Missing context remains visible. Repetition is not treated as independent corroboration merely because several feeds carry the same story.

Learn from decisions people can explain

Useful feedback needs a clear target. An association decision concerns an exact evidence-to-subject pair. A material-change decision concerns the difference between reviewed revisions. Relevance and actionability concern a particular assessment, rather than an unversioned title in a queue.

Threat Foundry retains those bindings with the reviewer and explanation. Permission checks determine whether evidence can be used for training; evaluated model versions and promotion controls govern their use. Suggestions support association review and elevation of relevant work. They do not silently rewrite source truth or turn a model prediction into an analyst approval.

For an enterprise, this provides feedback grounded in its environment. For an MSP or MSSP, tenant boundaries preserve each customer’s evidence, permissions and operating context.

From a changed report to a better next action

Consider a software vulnerability first reported without an actionable detection path. A later source adds exploitation detail and identifies an affected version. The useful question is whether that update changes the current assessment for an environment using that version.

Subject association connects the new evidence to the right assessment. Material-change review identifies the substantive update. Relevance and actionability help determine whether it deserves attention and what work to consider next. An analyst can inspect the evidence behind each step instead of starting again with every copied article.

Carry the context into investigation

Unified CTI ML is the first part of a connected workflow. Comprehensive Auto Triage can move eligible intelligence through coverage checks and bounded hunting under an explicit tenant policy. Multistage attack detection connects ordered observations in one investigation.

The value comes from continuity: the investigation retains why the intelligence mattered, which source version supported it and what the resulting work actually established.

Explore Unified CTI ML, Auto Triage and multistage attack detection, or discuss your intelligence workflow.