[Threat Actor (Group)] Quick Knowledge

[Threat Actor (Group)] Quick Knowledge Quick Knowledge is a custom OpenCTI dashboard view tailored to the Threat Actor (Group) entity type, built to give analysts and stakeholders an at-a-glance understanding of a threat actor's activity without needing to navigate through multiple tabs.

The layout is organized into four thematic sections:

• High Level Indicators: instant counters for total victims, malware leveraged, attack patterns, exploited vulnerabilities, related reports, and known indicators (IOCs), giving a quantitative snapshot of the group's footprint.
• Victim Targeting: visualizes who is being targeted — the top targeted sectors (bar chart), a geographic map of targeted countries, and a detailed list of the top targeted organizations with source/target relationship metadata.
• Arsenal & Techniques: surfaces the group's tradecraft — MITRE ATT&CK techniques, malware and tools used, and vulnerabilities exploited, each as ranked bar charts (most recent relationships first).
• Activity & Intelligence: tracks the group's recent activity, including a monthly activity timeline, the latest related reports (with type, creation date, labels, and markings), and the most recently seen indicators and observables tied to it.

This view is designed to be used as a quick-reference briefing tool, ideal for Analysts who need to rapidly assess an threat actor group's scope, targeting, tools, and recent activity during investigations.