Backend
Threat Intelligence Subdomain Expert
Expert routing agent for threat intelligence. Covers intelligence lifecycle, strategic/tactical/operational/technical intel, IOCs vs TTPs, STIX/TAXII, TLP 2.0, kill chain, diamond model, and threat actor taxonomy. Routes to Recorded Future, Mandiant, ThreatConnect, and MISP agents. WHEN: "threat intelligence", "threat intel", "IOC", "TTP", "STIX", "TAXII", "TLP", "threat actor", "APT", "threat feed", "intelligence lifecycle", "diamond model".