# Cti Hyperloop

> Use when the user asks about the CTI Hyperloop framework, the intelligence lifecycle as a high-tempo loop, or how to map intelligence work across strategic / operational / tactical levels with bidirectional feedback. Liberty91's operational doctrine.

- Skill: `liberty91ltd/cti-hyperloop` (Agent Skill)
- Install (CLI): `npx skillmds@latest add liberty91ltd/cti-hyperloop`
- Raw SKILL.md: https://api.skillmd.com/api/skills/liberty91ltd/cti-hyperloop/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Liberty91LTD (https://skillmd.com/u/liberty91ltd)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/liberty91ltd/cti-hyperloop

---


# CTI Hyperloop Framework

The CTI Hyperloop (based on Google/Mandiant's practical implementation framework) extends the traditional intelligence cycle by running it at three levels simultaneously with continuous bidirectional feedback.

## Core Concept

Traditional intelligence cycle: linear, single-track, often stuck at the tactical level.
Hyperloop: three parallel tracks (strategic, operational, tactical) feeding each other continuously.

```
STRATEGIC  ←→  OPERATIONAL  ←→  TACTICAL
    ↓              ↓               ↓
Direction → Collection → Processing → Analysis → Dissemination → Feedback
    ↑                                                              |
    └──────────────────────────────────────────────────────────────┘
```

## Intelligence Levels

### Strategic Intelligence
- **Time horizon**: 6-24 months
- **Consumers**: CISO, Board, Risk Management, Security Architecture
- **Focus**: Threat landscape trends, emerging threats, geopolitical developments, sector risk posture
- **Products**: Threat landscape reports, strategic assessments, horizon scanning reports, maturity assessments
- **Example PIR**: "How will the ransomware threat landscape evolve over the next 12 months and what are the implications for our risk posture?"

### Operational Intelligence
- **Time horizon**: Weeks to months
- **Consumers**: SOC Manager, IR Lead, Security Operations
- **Focus**: Active campaigns, threat actor profiling, TTP analysis, vulnerability exploitation trends
- **Products**: Campaign reports, threat actor profiles, operational assessments, hunt packages
- **Example PIR**: "What TTPs are currently being used by groups targeting our sector?"

### Tactical Intelligence
- **Time horizon**: Hours to days
- **Consumers**: SOC Analysts, Detection Engineers, IR Analysts
- **Focus**: IOCs, detection rules, immediate response support, indicator enrichment
- **Products**: IOC packages, SIGMA/YARA/KQL rules, flash reports, enrichment reports
- **Example PIR**: "What IOCs are associated with the current wave of attacks targeting our VPN appliances?"

## Phase Mapping to Platform

### Phase 1: Planning & Direction
**What**: Define what intelligence is needed and set priorities.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| Strategic | Set/review PIRs, horizon scanning briefs | orchestrator | pir-management, stakeholder-management |
| Operational | Define collection priorities for active investigations | orchestrator | pir-management, sops |
| Tactical | Identify IOC collection gaps, detection coverage gaps | orchestrator | sops |

### Phase 2: Collection
**What**: Gather raw data from relevant sources.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| Strategic | Trend monitoring, landscape research | osint-researcher | osint-methodology |
| Operational | Threat actor tracking, campaign research, dark web monitoring | osint-researcher, tool agents | osint-methodology, darkweb-collection |
| Tactical | IOC lookups, bulk enrichment | tool agents, ioc-processor | tool-api skills, ioc-enrichment-workflow |

### Phase 3: Processing
**What**: Normalise, deduplicate, and structure collected data.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| All | IOC deduplication, format normalisation, source assessment tagging | ioc-processor | ioc-enrichment-workflow, source-assessment |

### Phase 4: Analysis
**What**: Apply human judgment to produce assessed intelligence.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| Strategic | Horizon scanning, maturity assessment, trend analysis | analyst | horizon-scanning, threat-assessment, maturity-assessment |
| Operational | ACH, threat actor profiling, campaign tracking | analyst | ach, threat-actor-profiling, campaign-tracking, key-assumptions-check |
| Tactical | IOC correlation, detection gap analysis, indicator pivoting | analyst | indicator-pivoting, vulnerability-intelligence |

### Phase 5: Dissemination
**What**: Deliver finished intelligence to stakeholders.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| Strategic | Landscape reports, annual assessments, board briefings | report-writer | intelligence-writing, writing-assessments, stakeholder-management |
| Operational | Actor profiles, campaign reports, operational assessments | report-writer | intelligence-writing, writing-assessments |
| Tactical | IOC packages, detection rules, flash reports | detection-engineer, ioc-processor, report-writer | sigma/yara/kql-writing, ioc-export, stix-bundle |

### Phase 6: Feedback
**What**: Assess effectiveness and refine direction.

| Level | Activity | Agent | Skills |
|-------|----------|-------|--------|
| All | Consumer feedback, source quality tracking, PIR refinement | orchestrator | feedback-loops, pir-management |

## Bidirectional Flow Examples

**Tactical → Operational**: IOC enrichment reveals infrastructure pattern shared across multiple incidents → triggers campaign tracking investigation.

**Operational → Strategic**: Campaign analysis identifies new nation-state actor shifting targeting to a new sector → feeds into strategic landscape assessment and PIR update.

**Strategic → Operational**: Horizon scanning identifies AI-augmented social engineering as emerging threat → creates operational collection tasking for specific TTP monitoring.

**Operational → Tactical**: Threat actor profiling reveals preferred exploitation technique → drives creation of specific SIGMA detection rules.

**Strategic → Tactical**: Risk assessment identifies unpatched VPN as critical exposure → prioritises vulnerability intelligence and IOC monitoring for VPN exploits.

**Tactical → Strategic**: Spike in credential-stuffing alerts → informs strategic assessment of the underground economy and infostealer trend.

## Orchestrator Workflow Mapping

When the orchestrator receives a task, it maps it to the Hyperloop:

| User Request | Primary Level | Hyperloop Phases | Key Agents |
|-------------|---------------|-----------------|------------|
| "Investigate this IP" | Tactical | 2→3→4→5 | Tool agents → IOC processor → Analyst → Detection engineer |
| "Profile this threat actor" | Operational | 2→3→4→5→6 | OSINT researcher → IOC processor → Analyst → Report writer → Update knowledge cell |
| "Write a threat assessment on X" | Strategic/Operational | 1→2→3→4→5→6 | Orchestrator (PIRs) → OSINT researcher → Analyst (SATs) → Report writer → Quality reviewer |
| "Enrich this IOC list" | Tactical | 2→3→5 | Tool agents → IOC processor → Export |
| "What's the current ransomware landscape?" | Strategic | 2→4→5 | OSINT researcher → Analyst (knowledge cell) → Report writer |
| "Create detection rules for APT28 TTPs" | Tactical | 4→5 | Analyst (knowledge cell) → Detection engineer |
| "Review our PIRs" | Management | 1→6 | Orchestrator (PIR management, feedback loops) |