[Intrusion Set] Quick Knowledge

[Intrusion Set] Quick Knowledge Quick Knowledge is a custom OpenCTI dashboard view tailored to the Intrusion-Set entity type, built to give analysts and stakeholders an at-a-glance understanding of a threat actor's activity without needing to navigate through multiple tabs.

The layout is organized into four thematic sections:

• High Level Indicators: instant counters for total victims, malware leveraged, attack patterns, exploited vulnerabilities, related reports, and known indicators (IOCs), giving a quantitative snapshot of the intrusion set's footprint.
• Victim Targeting: visualizes who is being targeted — the top targeted sectors (bar chart), a geographic map of targeted countries, and a detailed list of the top targeted organizations with source/target relationship metadata.
• Arsenal & Techniques: surfaces the intrusion set's tradecraft — MITRE ATT&CK techniques, malware and tools used, and vulnerabilities exploited, each as ranked bar charts (most recent relationships first).
• Activity & Intelligence: tracks the intrusion set's recent activity, including a monthly activity timeline, the latest related reports (with type, creation date, labels, and markings), and the most recently seen indicators and observables tied to it.

This view is designed to be used as a quick-reference briefing tool, ideal for Analysts who need to rapidly assess an intrusion set's scope, targeting, tools, and recent activity during investigations.