Threat Technique & IOC Digest
Weekly new attacker techniques and campaigns mapped to MITRE ATT&CK, plus telemetry signals, detection ideas for your stack and ingestible indicator lists.
Built for security analysts and detection engineers tracking MITRE ATT&CK techniques relevant to their environment.
Why this work is hard
Security analysts and detection engineers tracking threats relevant to their environment spend hours on this by hand: finding the right sources, reading them, checking them against each other and writing up what matters. The work is repetitive, it is easy to miss something, and nobody can show where a claim came from.
Threat Technique & IOC Digest does that work as a GREP AI agent. It runs weekly and delivers each edition without you asking. Every run delivers a formatted brief, with every claim linked to its source.
What you get
What Threat Technique & IOC Digest delivers
FAQ
What does Threat Technique & IOC Digest need to run?
Threat Technique & IOC Digest needs threat focus: actors, threat types or sectors and environment / telemetry stack; indicator output format (optional) is optional.
How often does Threat Technique & IOC Digest run?
It runs weekly and delivers each edition without you asking.
What does Threat Technique & IOC Digest deliver?
Every run delivers a formatted brief, with every claim linked to its source.
Can I change what Threat Technique & IOC Digest does?
Yes. Every GREP AI agent can be cloned into your workspace, where you can edit its instructions, add your own sources and files, and change its schedule.
How are MITRE ATT&CK IDs verified?
Each technique and sub-technique ID is checked against the current matrix at attack.mitre.org and given its exact current name. Deprecated or guessed IDs are not used, and a procedure that fits no technique cleanly is noted as such.
Which query language do the detection ideas use?
The one your stack implies, such as KQL for Sentinel or Defender, SPL for Splunk, or ES|QL or EQL for Elastic. When no language is implied, it writes Sigma. Detection ideas are sketches to adapt and test, not validated rules.
How are indicators handled?
Only indicators published by a named source are included, each with a date and a confidence level. Network indicators are defanged, such as example[.]com, hashes stay as published, and likely stale or shared indicators are flagged.
More agents like this
- Runs on a schedule, weekly
Cyber Threat Watch
Weekly cyber threat intelligence on breaches, ransomware, exploited vulnerabilities, attack techniques and advisories hitting your industry, region or technology, with concrete defenses.
Formatted briefView → - Runs on a schedule, weekly
Stack Vulnerability Digest
Weekly CVE alerts for your stack, or daily if you choose: new CVEs, actively exploited flaws, vendor advisories and security releases, with severity, exploit status and the fix or mitigation.
Formatted briefView → - Runs over a list
Vendor Security Precheck
Prefills a vendor security review for each vendor you list from public evidence: certifications, trust center, breaches, data location and subprocessors.
Sourced reportView → - Runs over a list
Batch Business Verification
Batch business verification for each business, vendor, supplier, signup or invoice on your list: registry, address, domain, sanctions and fraud checks with a pass, review or block verdict.
Sourced reportView → - Runs over a list
Batch License and Provider Vetting
License verification for each company or provider you list against official licensing registers for the license and jurisdiction you name, with enforcement checks plus any bonding, insurance or complaints checks you request.
Sourced reportView → - PremiumRuns on demand
Business Proof of Address Verification
KYB verification of a business's uploaded proof of address, checked against its registered name and address: recency, authenticity and fraud signals.
Sourced reportView →
Run Threat Technique & IOC Digest in minutes.
Free to start. Run it once, put it on a schedule, or clone it and make it yours.