Feedly

Before launch, we handed this (free) skill to 12 CTI practitioners to test on attacks they are currently tracking. Their feedback is built into this skill. /track-cyberattack takes a named attack or campaign and turns it into: • An interactive tracker dashboard • An attack report and an executive brief • A STIX 2.1 bundle • MITRE ATT&CK Navigator layers Every claim is graded on the Admiralty Scale and linked to the exact line of the source it came from, so you can check the work before it reaches leadership. It's free, runs with or without a Feedly account, and you can edit every part of it to fit your team. Big thanks to the CTI practitioners who tested it and shared feedback before launch: Abdul Mateen, Carolina V., Daksh Gajjar, Dale Kauffman, Dan Gittis, Hunter Brumelow, Jason Tant, Jeremy Miller, Joseph Harrison, Mate Matijašević, Nermin S., Samhita Vempatti. Try it on the attack your stakeholders are asking about this week 👇 https://lnkd.in/gvp-q-zm

Grateful to serve as a community reviewer for another great Claude CTI skill from Josh Darby MacLellan and team! The track-cyberattack skill takes a named attack or campaign and turns it into an attack tracker dashboard in Claude, with a report (docx), executive brief, a STIX 2.1 bundle, and ATT&CK Navigator layer. I’m a stickler for BLUFs and love the executive overview provided by these reports! Check it out here: https://lnkd.in/eg_m2R8z

Feedly just released track-cyberattack, a Claude skill that turns an incident into a dashboard, a Word report and a STIX bundle, all built from one graded evidence ledger. I tested it before launch. I ran it on three real incidents: Salesloft Drift, Jaguar Land Rover, and an update run on Drift. In every run the structural checker passed the draft with 0 errors and 0 warnings, and the independent audit still found real problems. In the Jaguar Land Rover run it caught four High findings, including an attribution that an actor's own claim could not support. That is the impact for analysts. A polished output is easy to produce. A skill that checks whether the evidence supports it is rarer. Two more ideas I am taking into my own reporting. Superseded claims stay visible, so the reader sees what changed. And an occurrence scale (Observed, Reported, Capability, Assessed) kept a ransomware group's claim from reading as an observed event. Thank you to Josh Darby MacLellan and the Feedly team for asking for feedback and building this in the open for all defenders to use! Link to the skill and how to use in the comments!

Cybersecurity just got a lot more… chilling. 🧊 Feedly just released a free Claude skill that builds a sourced attack tracker, using this campaign as its worked example. I had the chance to test it before release, and I’ll be honest: I’ve tried a lot of AI tools that promise to “transform intelligence workflows” and mostly transform my afternoon into cleanup. This is one of the (very rare) ones that’s genuinely useful. Every claim traces back to its source, judgments are graded rather than hyped, and it clearly reflects how analysts actually work. Link in the comment ...which seems to be a thing nowadays. Stay cool out there... when freezers are getting heated. Literally. Thanks, Josh Darby MacLellan and the Feedly -Team, for looping me in and giving me a chance to contribute. Looking forward to more... #Cybersecurity #OTSecurity #ThreatIntelligence #Retail #CriticalInfrastructure #IoT

On December 2 I’ll be demoing YOINK! at a free CTI session hosted by Feedly, together with four other tool builders. Five tools, 10 minutes each, no sales pitches. Also on the Linup : OpenSourceMalware by Jenn Gile Cyproxy by Chris Kirby zsazsa by Koen Van Impe Track-cyberattack Claude Skill by Josh Darby MacLellan About YOINK! YOINK! is a single HTML file that pulls IOCs out of raw text and exports them to CSV, JSON or STIX 2.1. No install, no internet connection, nothing leaves your machine. Paste in a report, a chat log or a messy email thread and get clean, usable indicators back. 📅 December 2, 9:00 PT / 18:00 CET Register here: https://lnkd.in/efTcSMge Can’t make it live? Sign up anyway and you’ll get the recording and resource list. Want to try YOINK! before then? 🔧 Get YOINK!: https://lnkd.in/eizsa8zB 🧪 Test YOINK!: https://lnkd.in/ec7mmCaX #cyber #cybersecurity #CTI #intelligence #webinar #YOINK!

Hey CTI community! Join me on December 2 for live, pitch-free demos of 5 free tools. Register here >>> https://lnkd.in/gMWX6X5K Here's what we'll cover - OpenSourceMalware (me): Use free, human-verified threat intel on recent supply chain attacks to hunt for malware on GitHub. - Cyproxy (Chris Kirby): MCP gateway that connects your AI agent to your whole security stack through a single link, with built-in hunting and triage skills. - YOINK! (Jeroen D.): An HTML file that extracts IOCs from raw text and exports them to CSV, JSON, or STIX 2.1, with no internet connection required. - zsazsa (Koen Van Impe): one place to manage stakeholders, intelligence requirements, analysis, and reporting. - track-cyberattack Claude Skill (Josh Darby MacLellan): input an attack or campaign name or report and get details, including a summary, TTPs, attribution, victimology, timeline, and STIX bundle.

We’re sponsoring the Threat Intelligence Track at SANS Institute Fall Cyber Solutions Fest 2026! Our Senior Threat Intelligence Advisor, Saif Patel, will be presenting: “Show, Don’t Tell: Using Threat Intelligence Visualization to Drive Action.” The session will cover: ✔️ How to match visual formats to different stakeholders and intelligence requirements ✔️ Using visualization to test your analysis ✔️ Speeding up link analysis, hypothesis testing, and attack-flow diagrams with AI-assisted workflows 📅 Happening on Nov 19th. Register: https://lnkd.in/gaaynKSn

Thrilled to be joining Feedly on 02 December to demo Cyproxy alongside four other free tools built by some of the most talented people in the Cyber Threat Intelligence space ... and there won’t be a sales pitch in sight. Let us show you the art of the possible. I’ll be showing how Cyproxy connects your AI agent to all your security tools (well the ones I have onboarded so far) and skills, to carry out investigations and manage workflows all through one single MCP. Also on the lineup: Jenn Gile with OpenSourceMalware, for hunting supply chain malware on GitHub Jeroen D. with YOINK!, for extracting and exporting IOCs Koen Van Impe with zsazsa, for managing intelligence requirements, analysis and reporting Josh Darby MacLellan with track-cyberattack, a Claude skill for researching attacks and campaigns If you fancy joining us, you can register here: https://lnkd.in/eGkdK6Sk Even if you are not currently working in the intelligence space, I am pretty sure there is something for everyone here. There’s also some big Cyproxy news coming very soon, so keep an eye on the page ... although the feed is currently empty, so there’s not really anything to look at ... but go look anyway or just follow me, either works 🤣 Hope to see you there!