What RaqibCTI actually produces, for whom, and on what cadence — grouped by the lifecycle phase each product serves. A stakeholder should be able to find their product here without asking what exists.
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Priority Intelligence Requirements → | All tiers | Continuous — coverage re-evaluated live; decision package regenerated on demand | Decision package, cited |
| Stakeholder register → | Admin | As stakeholders/cadences change | Register |
| RFI intake → | Any signed-in stakeholder → admin response | Ad hoc, per request | Q&A thread |
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Latest Intel (Radar feed) → | Analysts | Continuous ingestion | Feed |
| Ransomware Watch → | Analysts | Continuous — live leak-site claims | Feed, claim-caveated |
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Campaign correlation → | Analysts | Live, computed on read | Cluster view |
| ATT&CK coverage → | Detection engineering | Continuous | Heat-map |
| Alerts (auto-generated) → | Analysts, detection engineering | Continuous — 14-day rolling window | High-confidence feed, JSON companion at /api/feed/alerts |
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Actor intelligence profiles → | All tiers | Updated as tracker research completes | Profile, cited |
| Pipeline case reports → | Technical / Executive (toggle) | Weekly (cyber-defense-intel pipeline) | Report, inferred tier (strategic/operational/tactical) |
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Ask AI → | Technical / Executive (toggle) | On demand, real time | Grounded Q&A, cited |
| KEV catalog + remediation priority → | Vulnerability management | Daily (CISA KEV sync) | Prioritized list, P1–P3 |
| SOC/SIEM feed → | Machines — SIEM / SOAR ingestion | Real time, pull-based | JSON |
| Compliance Lens → | GRC / compliance | Continuous | Control mapping |
| Product | Audience | Cadence | Format |
|---|---|---|---|
| Feedback loops → | Analysts, admin | Continuous — per-vote | Usage rollup |
Named on purpose — a stakeholder should know the blind spots exist rather than assume silence means safety.
| Area | Phase | Status & why |
|---|---|---|
| Brand & Dark Web Intelligence | Collection | NOT COLLECTED — no social / paste-site / leak-site mention monitoring. Blocked on legal review per jurisdiction, OPSEC separation, and metadata-only retention, not engineering. No signal here means "not watched," not "nothing found." |
| Email alert delivery | Dissemination | Pull-based delivery exists (/api/feed/alerts); email push is deferred on an undecided provider + double opt-in consent. A no-PII push channel (Web Push / RSS) is buildable without that. |