--- title: Intel slug: intel docTags: createdAt: 2024-10-17T18:34:50.326Z --- The **Intel** tab in Threat Flow gathers all of your intelligence in one place, where you can review the latest reports from Flare, create your own, and download any of them for further research. There are two types of Intel: ## Flare Intel Available to all Flare customers, Flare Intel covers specific themes and industry verticals. It is vetted, updated, and published by Flare's analysts, with new Intel released almost every day. ## Custom Intel Custom Intel lets you build your own intelligence from ongoing conversations on the dark web, scoped to what matters to your organization. :::hint{type="info"} Access to Custom Intel requires an add-on. Please reach out to your CSM for more information. ::: Click through the following product tour to learn how to regularly receive intelligence relevant to your organization. :::Iframe{iframeHeight="0" code="
"} ::: # Receiving Flare Intel You can stay up to date on Flare Intel in two ways, depending on whether you prefer to check in yourself or have updates delivered to you: - Check the **Intel** tab in Threat Flow for the latest reports. - Subscribe to the Flare Intel newsletter by clicking **Configure Flare Intel**. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/q5fe4POlZmxJx4y2M_G_0_image.png" size="70" isUploading="false" width="1262" height="1180" darkWidth="1262" darkHeight="1180" position="flex-start" showCaption="false"} Here you can choose the themes and industries you are interested in and configure which addresses the newsletter is sent to. There is no limit to how many you can add. ***Newsletters are sent every Monday at 7:00AM UTC*** *** # Receiving Custom Intel Custom Intel lets you build your own intelligence from ongoing conversations on the dark web, scoped to what matters to your organization. Follow these steps to create a custom intelligence report: ::::WorkflowBlock :::WorkflowBlockItem From Threat Flow, view the **Intel** tab. ::: :::WorkflowBlockItem Click **Create Custom Intel **and describe the intelligence you are looking for. See [Custom Intel Prompt guide](docId\:VX9CxFqQTc833VJ-yhbdp) for best practices and examples. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/QRFi2I_QO7bYF6n-TozQl_image.png" size="70" isUploading="false" width="1430" height="1210" darkWidth="1430" darkHeight="1210" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **Submit**. Flare generates the report in a few minutes and shows an estimate of how long it will take to compile. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/IN8eXuGErO4GY6eB9Z9vS_image.png" size="70" isUploading="false" width="1406" height="330" darkWidth="1406" darkHeight="330" position="flex-start" showCaption="false"} ::: :::: # Custom Intel Prompt Guide The quality of a Custom Intel report depends on the prompt behind it. Use these ready-to-use prompts to get started, organized by use case. Pick a category, replace the text in brackets with your own details, and run the prompt. ::::ExpandableHeading ### Threat landscape by industry :::BlockQuote Provide a summary of the most critical cybersecurity trends affecting the \[INDUSTRY] industry, focusing on emerging threats and systemic risks. ::: :::BlockQuote What threat actors are targeting the \[INDUSTRY] industry in \[COUNTRY]? ::: :::BlockQuote Ransomware trends impacting \[INDUSTRY] in \[COUNTRY/REGION] in the last 90 days. ::: :::: ::::ExpandableHeading ### Regional threat monitoring :::BlockQuote Recent cyberattacks and ransomware activity in \[COUNTRY/REGION]. ::: :::BlockQuote Provide all cyber incidents in \[YEAR] for \[COUNTRY]. ::: :::: ::::ExpandableHeading ### Ransomware and threat actor tracking :::BlockQuote Create a threat profile for \[GROUP\_NAME], including TTPs, recent victims, and targeted industries. ::: :::BlockQuote What are the five most active ransomware groups right now? ::: :::BlockQuote Recent \[GROUP\_NAME] victims and activity. ::: :::: ::::ExpandableHeading ### Vulnerability intelligence :::BlockQuote Recently disclosed and actively exploited CVEs targeting \[INDUSTRY] infrastructure, including VPN appliances, remote access tools, and network edge devices. ::: :::BlockQuote Is there any evidence of exploit code or threat actor interest for \[CVE-ID]? ::: :::: ::::ExpandableHeading ### Organization and brand monitoring :::BlockQuote Are there any leaks, breaches, or discussions involving \[COMPANY\_NAME] or \[DOMAIN]? ::: :::BlockQuote Are there any leaked credentials related to \[DOMAIN/EMAIL]? ::: :::BlockQuote What mentions of \[COMPANY] have appeared on Telegram channels or the dark web? ::: :::: ::::ExpandableHeading ### Recurring briefings :::BlockQuote Summary of key cybersecurity events in \[MONTH] \[YEAR] affecting \[INDUSTRY] in \[COUNTRY]. Provide references where possible. ::: :::BlockQuote Emerging threat intelligence from the past 7 days for a weekly briefing. ::: :::: ::::ExpandableHeading ### Phishing, fraud, and social engineering :::BlockQuote Recent phishing campaigns and scams targeting \[INDUSTRY] companies. ::: :::BlockQuote Known fraud campaigns involving \[METHOD] impersonation targeting \[SECTOR/COUNTRY]. ::: :::: ::::ExpandableHeading ### Geopolitical and nation-state threats :::BlockQuote Recent cyberattacks originating from \[COUNTRY] targeting \[SECTOR/REGION]. ::: :::BlockQuote Nation-state actors targeting \[SECTOR]: what should we watch for? ::: :::: ::::ExpandableHeading ### Technical IOCs and TTPs for SOC teams :::BlockQuote Provide TTPs and IOCs for \[THREAT\_ACTOR/CAMPAIGN]. ::: :::BlockQuote Which IOCs are new or trending in attacks against \[INDUSTRY]? ::: :::BlockQuote MITRE ATT\&CK techniques used by threat actors targeting \[INDUSTRY] in \[COUNTRY]. ::: :::: :::hint{type="info"} ### Tips for better results - Be specific. Combine industry, country, and time frame, for example: Ransomware in healthcare in the UK in the last 90 days. - Ask for references. Add "Provide references where possible" to the end of a prompt. - Set a time window, such as "in the last 7, 30, or 90 days" or "in \[MONTH] \[YEAR]." - Automate your monitoring. Reuse recurring prompts daily or weekly for continuous coverage. ::: *** # Sharing Custom Intel To share Custom Intel, download it and send it to the relevant stakeholders: ::::WorkflowBlock :::WorkflowBlockItem In the **Intel** tab, select the Custom Intel report you want to share. It opens in the details pane on the right. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/qeg46ctkvi4zN-mBCBJmA_image.png" size="90" isUploading="false" width="2030" height="1092" darkWidth="2030" darkHeight="1092" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click the **Export Intel **icon in the top right of the report. ::: :::WorkflowBlockItem Choose **Download as DOCX** or **Download as PDF** to download and share the report. ::: ::::