Threat Intelligence Enrichment

Workflow

Use Tavily's MCP search and extract tools to enrich security entities with authoritative and recent evidence; use map or crawl for known vendor portals or advisory collections. Keep this skill focused on query construction, source priority, verification, and security synthesis.

Treat the guidance below as base guidance; adapt it to the user's request when appropriate.

• Identify the input type: CVE, IOC, malware/tool, threat actor, vendor/product, advisory URL, incident, or campaign.
• Break the task into short subqueries under 400 characters: identifier, affected product, exploit status, vendor advisory, patches, mitigations, exploitation in the wild, and recent reporting.
• Search first, using exact-match style queries for CVEs, hashes, domains, IPs, advisory IDs, and malware names.
• Filter sources before extraction. Prioritize NVD/CVE records, vendor advisories, CISA/agency alerts, security research blogs, reputable incident reports, and official patch notes.
• Extract selected pages that can support exploit status, impact, affected versions, mitigations, timeline, or confidence.
• Use site navigation for vendor advisory portals or documentation sites when the relevant page is hard to find.
• Collect scoped advisory, changelog, release note, or documentation sections only when the user needs broad coverage.

Research Budget

• Start with a small focused search set covering the identifier, vendor advisory, exploit status, and mitigation or patch evidence.
• Extract only the strongest authoritative sources before drafting.
• Add more searches only for named gaps, such as missing affected versions, missing patch notes, or unclear exploitation status.
• Do not use map unless a known vendor portal or documentation site has a specific advisory or release note to locate.
• Do not use crawl unless the user asks for coverage across many related advisories or docs pages.

Capability Guidance

• Use search for CVEs, IOCs, advisories, exploit status, affected versions, mitigations, and recent incident reporting.
• Use extract on selected vendor advisories, CVE records, agency alerts, patch notes, and security research pages.
• Use map when a vendor portal or documentation site is known but the specific advisory is hard to locate.
• Use crawl for advisory/doc sets only when the user asks for coverage across many related pages.
• Use research only for threat landscape reports or multi-campaign summaries.

Query And Source Guidance

• Use exact identifiers in queries: CVE IDs, advisory IDs, product/version names, hashes, domains, IPs, malware names, and actor aliases.
• Prioritize vendor advisories, NVD/CVE records, CISA or national agency alerts, CERT/CC, official patch notes, and reputable security research.
• Treat social posts, exploit-db style references, and secondary news as supporting evidence unless confirmed by authoritative sources.
• Separate "exploited in the wild", "public PoC", "theoretical exploitability", and "patched" as different statuses.
• Report failed or inaccessible sources when they affect vendor advisories, CVE records, affected-version evidence, or mitigation guidance.

Output Template

Use this markdown structure and label uncertainty:

# Threat Intelligence Brief: <entity>

## Summary
- Current status:
- Confidence:
- Most important source:

## Entity Details
- Type:
- Aliases/identifiers:
- Related products or systems:

## Impact And Exposure
- Affected products/versions:
- Exploit status:
- Evidence quality:

## Mitigation And Detection
- Patches or mitigations:
- Detection or hunting notes:
- Recommended checks:

## Timeline
- <date>: <event> ([source](URL))

## Sources And Gaps
- Sources:
- Gaps or unresolved claims:

Do not overstate attribution, exploitation, or compromise evidence. Label speculation and unverified claims.