Agent Registry·Intelligence·Threat Intel Analyst

Intelligenceclaude-sonnet-4-6Open source · Free to copy

Threat Intel Analyst

Monitors CISA KEV, CVEs, and threat feeds. Translates exploits into GRC control gaps.

Fetches live threat intelligence from CISA KEV, NVD, and ISAC feeds. For each active threat, maps it to the controls that would prevent or detect it, scores your organization's exposure, and drafts a management-ready threat brief.

Tools:web_searchweb_fetch

Frameworks:NIST CSFCIS ControlsCMMCISO 27001

Use case 1

You need a weekly threat brief but do not have a dedicated CTI analyst on staff

→ Curated 5–10 minute read with only the threats relevant to your stack, mapped to specific controls and concrete remediation actions

Use case 2

CVE drops and an executive asks 'are we exposed?'

→ Stack-aware analysis with the specific controls that mitigate, evidence to check, and a defensible patch priority

Use case 3

Translating technical threat intelligence into GRC findings or board-level risk reporting

→ Plain-language risk brief with dollar exposure estimates, control-coverage view, and recommended treatment investments

Try a sample prompt:

threat-intel-analyst · live demo · gemini-flash

◇ Curated sample output (real format)

Threat Brief · 2026-05-09 · For: Acme (M365 + AWS + Windows)

#1 · CVE-2026-2341 · Microsoft Defender for Cloud Apps Privilege Escalation

CVSS: 9.4 (Critical) · KEV: Added 2026-05-07, due date 2026-05-21

Affects: Defender for Cloud Apps connector for Office 365 (versions before 2026.4.2)

Exploitability: Active exploitation reported by 2 ISACs. PoC public on GitHub since 2026-05-05.

Control coverage that prevents this:

- NIST 800-53 SI-2 (Flaw Remediation) — patch cadence

- CIS Controls 7.4 (perform vulnerability scanning)

- CMMC SI.L2-3.14.1 (identify, report, correct system flaws)

Evidence question for your GRC team: Can we produce a patch deployment record for Defender connector in last 14 days? If not, this is a finding waiting to happen.

Recommended action:

1. Verify M365 admin → Settings → Cloud Apps → Connectors version

2. If below 2026.4.2 → emergency change ticket TODAY

3. Verify Defender alerts not silently muted (compromised attackers often disable detections first)

#2 · CVE-2026-1899 · AWS Lambda Authorization Bypass (resource policy)

CVSS: 8.8 (High) · KEV: Not yet listed

Affects: Lambda functions using resource-based policies with broad Principal: "*" + wildcard SourceArn

Exploitability: Theoretical. AWS pushed a service-side hotfix on 2026-05-06.

Control coverage:

- SOC 2 CC6.1, CC6.3 — least privilege

- ISO 27001 A.5.15 — access control to source code

Evidence question: Pull our Lambda function policies. Any with Principal: "*" and ambiguous SourceArn?

Action: Run aws lambda get-policy audit script across all functions. AWS-side fix applied but defense in depth requires explicit Principal narrowing.

#3 · MITRE ATT&CK T1606 · OAuth App Phishing Surge

Type: Tactic trend, not specific CVE

Affecting: Microsoft 365 / Google Workspace / GitHub OAuth flows

Source: Mandiant M-Trends 2026 + CISA advisory AA26-0508A

Observed: 340% spike in malicious OAuth consent attacks Q1 2026

Control coverage:

- NIST 800-53 AC-6, AC-7

- CIS Controls 4.7 (manage default accounts)

- Microsoft secure score recommendation: restrict user consent to verified publishers only

Evidence question: Is M365 user consent restricted to verified publishers + low-risk permissions? Pull Get-MgPolicyAuthorizationPolicy.

Action: Lock down user consent settings. Phishing simulation should test OAuth consent specifically next quarter.

Management Summary (3 sentences for the CEO digest)

Microsoft patched a critical Defender for Cloud Apps vulnerability under active exploitation — our patch status needs verification within 48 hours. AWS Lambda permission-bypass was patched server-side but our policies should be audited for defense in depth. Phishing attacks are increasingly using OAuth consent abuse — we should lock down M365 user consent settings this quarter.

What we are NOT calling out (filtered noise)

- CVE-2026-9911 NetGear router RCE (no consumer NetGear in our env)

- CVE-2026-8772 Apache Struts (we use FastAPI, no Struts deployment)

- 18 other CVEs published this week without exploitation evidence or stack relevance

Cmd+Enter to send

← Back to agent registry