Having recently completed a thorough evaluation of various threat intelligence platforms for a client's AI-powered SOC orchestration project, I was struck by a recurring operational gap: the efficient, contextual tracking of high-priority threat actors across multiple campaigns and intelligence sources. While CrowdStrike Falcon Intelligence provides a rich stream of data, operationalizing it alongside internal findings and third-party reports requires a structured, queryable system.
To address this, I've developed a comprehensive Notion template designed specifically for security analysts and threat intelligence teams. It moves beyond simple bookmarking or note-taking and structures actor profiling in a way that facilitates both daily workflow and long-term trend analysis. The template is built around a relational database architecture within Notion, which allows for powerful linking and filtering.
The core components of the template are:
* **Actor Master Database:** The central table containing canonical profiles for each tracked actor. Each entry includes fields for:
* Primary alias(es) and CrowdStrike's associated adversary designations (e.g., PINECONE, STOLEN PASSWORD).
* Associated malware families, tools, and techniques (MITRE ATT&CK IDs can be linked here).
* Confidence level in attribution (High/Medium/Low, with a field for justification).
* Active status and last observed date.
* A summary of objectives and typical victimology.
* **Campaign Log Database:** A separate, but linked, database for logging specific campaigns or incidents. Each campaign record:
* Links to one or more threat actors from the master database.
* Records initial detection, containment, and eradication dates.
* Includes fields for associated indicators (IPs, domains, hashes), which are stored in a dedicated, filterable "Indicators" property.
* Contains a timeline view for chronological logging of events and analyst actions.
* **Intelligence Source Tracker:** This module is crucial for grounding assessments in evidence. It logs individual intelligence reports (from CrowdStrike, blogs, vendor reports) and links them to both actor profiles and campaign logs. Fields include source URL, publication date, key findings, and a "reliability score" based on the source's historical accuracy.
The relational structure means you can, from a single actor profile page, instantly see all linked campaigns, all sourced intelligence reports, and all recent indicators. This is particularly useful for creating briefings or when a new report drops and you need to quickly assess its relevance to your current priority list.
For those interested in the implementation, the core relational property setup in Notion's database is straightforward. While Notion doesn't use SQL, the conceptual model looks like this:
```yaml
# Conceptual Schema for Notion Template
ThreatActor:
- properties: name, aliases, confidence, status, objectives
- relations: campaigns, intelligence_sources, techniques
Campaign:
- properties: name, start_date, status, indicators
- relations: linked_actors, related_intelligence
IntelligenceSource:
- properties: title, url, source_vendor, publication_date, reliability
- relations: relevant_actors, relevant_campaigns
```
This template has been instrumental in transitioning from a reactive, alert-by-alert workflow to a more strategic, actor-centric one. It helps answer questions like "What is Actor X likely to target next based on their last three campaigns?" or "How does this new CrowdStrike report on PINECONE alter our risk assessment for our APAC subsidiaries?" I am happy to share a public duplicate link for the community to clone and adapt. I am also keen to hear how others are structuring such tracking, and if there are specific CrowdStrike Falcon Intel data points or API fields that would be valuable to integrate directly.