RaqibCTI runs on Priority Intelligence Requirements — standing questions that direct collection, track coverage gaps, and turn raw signal into decision-ready answers, not another undifferentiated feed. Citation-backed actors, ATT&CK coverage, and CISA KEV cross-references for the Middle East & North Africa, kept current by a daily sync.
Standing Priority Intelligence Requirements drive what gets tracked — live coverage badges show exactly which questions have real answers and which are still gaps.
/requirements → · 0CollectionA live regional feed plus a dedicated ransomware-claim watch, weighed against internal hunt data rather than taken at face value.
/intel →AnalysisRaw signal becomes intelligence once it's tied to a campaign, timeframe, and technique — every TTP is ATT&CK-tagged and checked against real detection coverage.
/campaigns →ProductionCitation-backed profiles for MENA-targeting APT, ransomware, and financially-motivated groups — the tactical foundation every other product builds on.
/actors → · 51DisseminationGrounded, cited answers over the full threat graph, CISA KEV cross-references, and threat-informed mapping to NCA ECC, NIST CSF, and ISO 27001.
/ask → · 7FeedbackThe most commonly neglected phase — RaqibCTI tracks whether intelligence actually gets used, not just whether it got published.
/feedback →