From Report to Action: A 48-Hour Threat Intelligence Workflow
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
A CISA advisory hits your inbox at 9 AM. By 9:15 AM, two colleagues have forwarded it with the subject line 'FYI.' By noon, nobody has done anything with it. ISACA has documented that what most organizations receive is not intelligence: it is raw data. The difference between data and intelligence is a workflow that converts an advisory into a queued action with an owner and a deadline. The 48-hour window matters because the median time to weaponize a disclosed CVE has dropped to just 5 days, and 12% of CVEs are weaponized within 24 hours of disclosure. This guide gives you the exact sequence of steps, decision points, and outputs for three report types: a CISA advisory, a vendor threat report, and a peer breach disclosure.
Step 1: Identify the Report Type Before You Read Past the Title
Not all threat intelligence reports are the same, and routing them to the wrong action queue is one of the most common reasons organizations fail to act. CISA advisories typically contain confirmed TTPs, associated CVEs with CVSS scores, and specific affected vendor/product pairings: they are the highest-urgency input because they represent active exploitation the government has confirmed. Vendor threat reports (from CrowdStrike, Mandiant, Recorded Future, and similar firms) mix intelligence with sales context, but the IOC appendices and MITRE ATT&CK technique mappings are operationally valuable regardless of commercial framing. Peer breach disclosures: shared through ISACs, FS-ISAC, H-ISAC, or directly from a peer organization: carry the highest contextual relevance for your vertical even when they lack technical depth. Spending 90 seconds on report-type classification before diving into the body determines which analyst owns the document, which tools receive the output, and how fast the clock is running.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
The 3x4 Action Matrix: Report Type Meets Output Category
Every threat report produces up to four categories of defensive output: a patch action, a detection deployment, an IOC blocking rule, and a configuration change. Not every report produces all four, but evaluating each column explicitly prevents gaps. The matrix below maps report type to expected output and responsible team. Running this mentally: or via a lightweight template in your ticketing system: takes under 10 minutes and creates a defensible audit trail showing the advisory was actioned, not just read.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
The 48-Hour Clock: Specific Actions by Hour
The value of a 48-hour framework is that it converts urgency into a schedule. Urgency without a schedule produces activity without outcomes: analysts read the advisory multiple times, discuss it in Slack, and open no tickets. The schedule below is designed for a CISA advisory at maximum urgency. For vendor reports, the Hour 1 actions shift to Hour 4, and the overall cadence relaxes by approximately one tier. For peer disclosures, the schedule mirrors CISA priority if the technology overlap is confirmed, or compresses to a single 24-hour pass if overlap is low.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Extracting Indicators vs. TTPs vs. Configuration Guidance
One of the most consequential analyst decisions is recognizing which type of intelligence the report actually contains, because each type routes to a different defensive tool. Indicators of compromise (IP addresses, domain names, file hashes, certificate thumbprints) are operationally useful for 24 to 72 hours and feed blocking and retrospective detection. TTPs expressed as MITRE ATT&CK technique IDs are durable for months to years and feed detection engineering and red team validation. Configuration guidance is prescriptive hardening advice that feeds your change management process and satisfies compliance frameworks. Reports almost always mix all three, and analysts who treat them uniformly end up blocking stale IPs while ignoring the configuration guidance that would have closed the actual attack path. The practical test: if the intelligence requires a firewall rule, it is an indicator. If it requires a SIEM rule, it is a TTP. If it requires a change ticket, it is configuration guidance.
Urgency Triggers: When to Escalate Beyond Standard Process
Standard process handles the majority of advisories. Three conditions trigger immediate escalation beyond the standard 48-hour workflow. First, active exploitation in your sector: if the advisory explicitly names your industry vertical or if an ISAC peer confirms active targeting, compress the Hour 24 and Hour 48 actions into Hour 4 and Hour 8 respectively. Second, CVE EPSS above 0.9: at this score level, the probability of observing exploitation in the wild within 30 days exceeds 90%: treat this as confirmed exploitation for scheduling purposes. Third, technology match on a zero-day: if the advisory describes a zero-day in software you operate and no patch is available, initiate compensating control deployment immediately and brief leadership within 2 hours. The 12% of CVEs weaponized within 24 hours of disclosure are concentrated in widely deployed software categories: web servers, VPN appliances, mail gateways, and remote access tools.
Worked Example: A CISA Advisory Drops on a Friday Afternoon
CISA publishes an advisory at 3:45 PM on a Friday covering active exploitation of a critical authentication bypass in a widely deployed VPN appliance. Your organization runs this appliance at three locations. Here is the exact action sequence. Hour 1 (by 4:45 PM): Classify as CISA advisory, highest urgency. Extract CVE, confirm it is on the KEV list. Check vendor advisory for patch availability: none exists yet, only a workaround. Assign the workaround implementation to the network engineering on-call. Push the disclosed C2 IP addresses and domains to firewall and DNS block lists. Page the CISO with a two-sentence summary. Hour 4 (by 8 PM): Confirm workaround applied at all three locations. Verify C2 blocks are active. Search SigmaHQ for rules matching the reported lateral movement technique (T1021.001); deploy the closest matching rule to SIEM. Hour 24 (Saturday): Run a 90-day retrospective hunt for the C2 indicators. Confirm no matches. Create a patch ticket triggered by vendor patch release with a 24-hour SLA from release. Hour 48 (Sunday): Document compensating controls in the risk register. Distribute Sunday morning summary to CISO and network engineering leadership.
The bottom line
Threat intelligence has no value without a workflow that converts it into scheduled, owned, time-bound actions. The 48-hour framework is not bureaucracy: it is the minimum structure required to ensure that a critical advisory does not expire in an inbox. Build the 3x4 matrix into your ticketing system as a template, assign default owners per report type, and run the EPSS check at Hour 1 every time. The 29% of CVEs weaponized within a week are not exploited because attackers are fast: they are exploited because defenders are slow to route the intelligence to the right hands.
Frequently asked questions
What is the difference between a threat indicator and a TTP?
A threat indicator is a specific, observable artifact tied to a known attack campaign: an IP address, domain name, file hash, or certificate thumbprint. Indicators are time-sensitive and expire as adversaries rotate infrastructure, typically within 24 to 72 hours for fresh campaigns. A TTP (tactic, technique, and procedure) describes adversary behavior at a higher level of abstraction: the technique used to achieve lateral movement, the method used to establish persistence, or the tool class used for command and control. TTPs are expressed in frameworks like MITRE ATT&CK and remain valid for months to years because adversaries do not change their fundamental behaviors as easily as they change their infrastructure. Operationally, indicators feed blocking rules while TTPs feed detection logic and red team validation priorities.
How should I prioritize CVEs from a CISA advisory when I cannot patch everything at once?
Use three filters in sequence. First, check the CISA Known Exploited Vulnerabilities catalog: any CVE on the KEV list has confirmed active exploitation and takes absolute priority regardless of CVSS score. Second, query the FIRST EPSS API for any CVEs not on the KEV list; EPSS scores above 0.5 indicate more than 50% probability of observing exploitation in the wild within 30 days and should be treated with the same urgency as KEV items. Third, for remaining CVEs, apply CVSS scores combined with asset exposure: a 9.0 CVSS on an internal-only system with no external exposure is lower priority than a 7.5 CVSS on an internet-facing authentication gateway. Document your prioritization rationale in the ticket so auditors can see the reasoning.
Where do I find Sigma rules matching a specific MITRE ATT&CK technique?
The SigmaHQ repository on GitHub organizes rules by ATT&CK technique ID in its directory structure, making it straightforward to search for a specific technique number and find community-maintained detection rules. Most rules include conversion notes for Splunk SPL, Microsoft Sentinel KQL, Elastic EQL, and other common SIEM query languages. When you identify a technique in a CISA advisory or vendor report, copy the technique ID (for example T1190 for Exploit Public-Facing Application), search the SigmaHQ repo for that string, and review available rules for coverage quality. Not all community rules are production-ready: evaluate false positive risk before deploying to a high-noise environment. For techniques with no existing Sigma rule, the technique page in the MITRE ATT&CK navigator includes data sources that tell you which log types would capture the behavior.
How do I handle a threat advisory that arrives outside business hours?
The answer depends on the urgency trigger conditions. If the advisory describes active exploitation of software you operate, it is an on-call event regardless of time: page the on-call analyst and the CISO. If the advisory is informational with no confirmed active exploitation and no technology match to your highest-risk assets, it can wait for the next business day with a documented receipt timestamp. The key is having a decision rule written down before the Friday afternoon advisory arrives, not improvising the decision at 4 PM. The decision rule should be part of your threat intelligence standard operating procedure and should specify who receives the page, what the on-call analyst is authorized to deploy without additional approval, and what the communication chain looks like to leadership.
What should a threat intelligence ticket contain at minimum?
At minimum, a threat intelligence action ticket should contain the source advisory with a direct URL or reference number, the report type classification, the specific action required (not just 'review the advisory'), the system or infrastructure scope, the assigned owner, and the deadline based on the urgency tier. If the action is a detection deployment, the ticket should include the Sigma rule or query being deployed. If the action is an IOC block, the ticket should list each indicator being blocked. If the action is a patch, the ticket should reference the CVE, the affected asset list, and the patch identifier. This level of documentation serves two purposes: it gives the assignee everything they need to act without re-reading the original advisory, and it creates the audit trail that satisfies compliance reviewers who need to see evidence of advisory actioning.
When should I share threat intelligence with peers or my ISAC?
Share with your ISAC as soon as you have confirmed technical details that are not already in the public advisory, particularly if you have observed active targeting of your organization or sector. Early sharing within trusted communities is one of the few collective defenses that improves outcomes for the whole sector. If you receive a peer breach disclosure, reciprocate by sharing what you observed in your own environment even if you were not breached: the absence of observed targeting is itself useful intelligence. Before sharing, strip any information that identifies customers, employees, or legally privileged incident response findings. Most ISAC memberships include legal safe harbors for good-faith sharing, but confirm with your legal team before disclosing anything that could be interpreted as an admission of a breach.
How do I know if my SIEM detection coverage matches the techniques in an advisory?
The most practical approach is to maintain a coverage map that ties each MITRE ATT&CK technique to a specific detection rule in your SIEM. When an advisory identifies a set of techniques, you cross-reference against the coverage map and immediately see which techniques have active detection and which are gaps. Tools like MITRE ATT&CK Navigator provide a free visualization layer for this. If you do not yet have a coverage map, start by pulling the top 20 techniques from the most recent CISA advisories in your sector and confirming whether you have a Sigma rule deployed for each. Build the map incrementally rather than trying to achieve full coverage before getting started.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.