RaqibCTI — MENA Cyber Threat Intelligence

Intelligence service catalog

20 products

What RaqibCTI actually produces, for whom, and on what cadence — grouped by the lifecycle phase each product serves. A stakeholder should be able to find their product here without asking what exists.
Reconciled with live wiring 2026-08-09 — every product below is data-backed (Ransomware Watch now persisted; the Analysis tier now populates on the daily extraction cron, not a manual trigger).
Handling (TLP): everything published here is TLP:CLEAR — public-read, freely shareable. The STIX 2.1 bundle carries the TLP:CLEAR marking-definition inline for downstream tooling.

Planning & Direction

Product	Audience	Cadence	Format
Priority Intelligence Requirements →	All tiers	Continuous — coverage re-evaluated live; decision package regenerated on demand	Decision package, cited
Stakeholder register →	Admin	As stakeholders/cadences change	Register
RFI intake →	Any signed-in stakeholder → admin response	Ad hoc, per request	Q&A thread

Collection

Product	Audience	Cadence	Format
Latest Intel (Radar feed) →	Analysts	Continuous ingestion	Feed
Ransomware Watch →	Analysts	Daily ETL — persisted MENA leak-site claims, actor-linked	Table, claim-caveated
CTI Library (ORKL) →	Analysts	Daily ETL — MENA-filtered ORKL archive	Reading room, third-party reporting, link-out only

Analysis

Product	Audience	Cadence	Format
Campaign correlation →	Analysts	Live, computed on read	Cluster view
Threat graph (actor overlap) →	Analysts	Precomputed each ETL	Force-directed graph, APT + ransomware
IOC graph →	Analysts, detection eng	On demand	Indicator pivot graph, defanged, dual-confidence
ATT&CK coverage →	Detection engineering	Continuous	Heat-map
Alerts (auto-generated) →	Analysts, detection engineering	Continuous — 14-day rolling window	High-confidence feed, JSON companion at /api/feed/alerts

Production

Product	Audience	Cadence	Format
Actor intelligence profiles →	All tiers	Updated as tracker research completes	Profile, cited
Cyber Threat Profile (MENA, v1) →	CISO / leadership / analysts	Synthesized live from tracked data	Outward threat-landscape synthesis (Diamond + Kill Chain + campaigns + exposure)
Pipeline case reports →	Technical / Executive (toggle)	Weekly (cyber-defense-intel pipeline)	Report, inferred tier (strategic/operational/tactical)

Dissemination

Product	Audience	Cadence	Format
Ask AI →	Technical / Executive (toggle)	On demand, real time	Grounded Q&A, cited
KEV catalog + remediation priority →	Vulnerability management	Daily (CISA KEV sync)	Prioritized list, P1–P3
SOC/SIEM feed →	Machines — SIEM / SOAR ingestion	Real time, pull-based	JSON
STIX 2.1 bundle →	Machines — TIP / TAXII / SIEM	Real time, pull-based	STIX 2.1 JSON (intrusion-sets + attack-patterns + relationships), TLP:CLEAR
Compliance Lens →	GRC / compliance	Continuous	Control mapping

Feedback

Product	Audience	Cadence	Format
Feedback loops →	Analysts, admin	Continuous — per-vote	Usage rollup

Coverage gaps · not collected

Named on purpose — a stakeholder should know the blind spots exist rather than assume silence means safety.

Area	Phase	Status & why
Brand & Dark Web Intelligence	Collection	NOT COLLECTED — no social / paste-site / leak-site mention monitoring. Blocked on legal review per jurisdiction, OPSEC separation, and metadata-only retention, not engineering. No signal here means "not watched," not "nothing found."
Email alert delivery	Dissemination	Pull-based delivery exists (/api/feed/alerts); email push is deferred on an undecided provider + double opt-in consent. A no-PII push channel (Web Push / RSS) is buildable without that.