threat_intel_brief
Generate a Targeted Threat Intelligence brief template compliant with TIBER-EU v2.0. Use this scaffold to brief a threat-intel provider on critical functions and geographic footprint.
Instructions
Generate a Targeted Threat Intelligence (TTI) brief template per ECB TIBER-EU v2.0.
This is a SCAFFOLD. Real TTI must be authored by an accredited threat-intel provider with current intelligence feeds. Use this template to brief them.
Args: entity_name: Legal name of the financial entity. entity_sector: One of retail-banking, wholesale-banking, insurance, asset-management, market-infrastructure, payments, e-money. geographic_footprint: List of country codes where entity operates (e.g., ["DE", "NL", "IE"]). critical_functions: List of critical functions for which threats must be modelled.
Returns: TTI template with sections aligned to TIBER-EU + ECB standards.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| entity_name | Yes | ||
| entity_sector | Yes | ||
| geographic_footprint | Yes | ||
| critical_functions | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- meok_dora_tlpt_planner/server.py:206-255 (handler)The 'threat_intel_brief' tool handler function. Uses FastMCP @mcp.tool() decorator. Takes entity_name, entity_sector, geographic_footprint, critical_functions and returns a dict with entity profile, TTI required sections, threat actor selection rationale, delivery requirements, and downstream use instructions.
@mcp.tool() def threat_intel_brief( entity_name: str, entity_sector: str, geographic_footprint: list[str], critical_functions: list[str], ) -> dict[str, Any]: """Generate a Targeted Threat Intelligence (TTI) brief template per ECB TIBER-EU v2.0. This is a SCAFFOLD. Real TTI must be authored by an accredited threat-intel provider with current intelligence feeds. Use this template to brief them. Args: entity_name: Legal name of the financial entity. entity_sector: One of retail-banking, wholesale-banking, insurance, asset-management, market-infrastructure, payments, e-money. geographic_footprint: List of country codes where entity operates (e.g., ["DE", "NL", "IE"]). critical_functions: List of critical functions for which threats must be modelled. Returns: TTI template with sections aligned to TIBER-EU + ECB standards. """ return { "tti_brief_type": "DORA Art. 26 / TIBER-EU v2.0 compliant scaffold", "entity_profile": { "name": entity_name, "sector": entity_sector, "geographic_footprint": geographic_footprint, "critical_functions": critical_functions, }, "required_sections": TTI_FIELDS, "minimum_threat_actor_count": 3, "threat_actor_selection_rationale": [ "At least 1 nation-state actor relevant to entity geography (e.g., APT28, Lazarus)", "At least 1 financially-motivated group (e.g., FIN7, Cl0p, BlackBasta)", "Optionally 1 hacktivist or insider-threat scenario for completeness", "Justify each selection with current threat-landscape evidence (last 6 months)", ], "delivery_requirements": { "format": "PDF + machine-readable JSON (STIX 2.1 preferred)", "page_count_typical": "60-120 pages", "delivery_to": "white-team-lead only (NEVER to red-team direct, NEVER to blue-team)", "retention_post_test": "7 years per DORA Art. 14", }, "downstream_use": [ "Red-team uses TTPs from TTI to drive engagement plan", "White-team uses TTI to validate test realism", "Lead overseer reviews TTI as part of test scope approval (Art. 26(7))", ], } - meok_dora_tlpt_planner/server.py:206-212 (registration)Tool registration via the @mcp.tool() decorator — the FastMCP framework auto-registers the function as an MCP tool named 'threat_intel_brief'.
@mcp.tool() def threat_intel_brief( entity_name: str, entity_sector: str, geographic_footprint: list[str], critical_functions: list[str], ) -> dict[str, Any]: - TTI_FIELDS constant used by the tool to define the required sections for the threat intelligence brief template (entity profile, threat actor selection, TTPs, access vectors, exfiltration scenarios, disruption scenarios, evidence sources, attribution confidence).
TTI_FIELDS = [ "Entity profile (sector, size, geographic footprint, critical functions)", "Threat actor selection (1-2 nation-state + 1-2 financially-motivated, justified per current threat landscape)", "TTPs per threat actor (mapped to MITRE ATT&CK Enterprise + ICS)", "Initial access vectors (phishing, supply-chain, vendor compromise, etc.)", "Data exfiltration scenarios (customer data, transaction records, IP)", "Disruption scenarios (ransomware, wiper, market manipulation)", "Evidence sources cited (MISP feeds, vendor reports, government advisories)", "Attribution confidence (HIGH/MEDIUM/LOW per ICD-203)", ]