# Threat Intelligence Platforms and Enrichment Workflows

> Manage indicators in a threat intelligence platform: normalise, deduplicate, enrich, score, allowlist, expire and assign dispositions.

Canonical: https://codelivly.com/rooms/cti-tip-enrichment-workflows
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

**Purpose.** Individual analysis does not scale without a system. This module explains, tool-neutrally, what a threat intelligence platform does and how to design the workflows inside it: normalisation, deduplication, enrichment, scoring, expiration, allowlists and disposition.

**Prerequisites.** Modules 1 to 4 of this learning path. No specific platform is required; examples refer to open-source platforms such as MISP and OpenCTI only for orientation.

**Learning outcomes.** After this module you can:

- Describe TIP functions and the observable, indicator, sighting, relationship and report data model, and measure feed quality.
- Normalise and deduplicate indicators by type while preserving URL case, provenance and handling labels.
- Score indicators with a transparent model, set expiry by type, and apply allowlists without discarding intelligence.
- Design a provenance-preserving enrichment pipeline that respects OPSEC, licences and rate limits, and assign a disposition with a recommended action.

**Practical completion objective.** Clean and normalise a messy partner indicator list ready for sharing, then score five enriched indicators, assign dispositions and actions, and write a complete enrichment record.

## Lessons

1. What a Threat Intelligence Platform Does (15 min)
2. Normalising and Deduplicating Indicators (15 min)
3. Scoring, Expiration, Allowlists and Disposition (15 min)
4. Designing Enrichment Workflows (15 min)
5. Lab: Defang, Refang and Normalise an Indicator List (40 min)
6. Lab: Build Enrichment Records and Assign Dispositions (50 min)

## Related

- [Learning path: OSINT and Indicator Analysis](https://codelivly.com/learning-paths/cti-osint-indicator-analysis)
- [All rooms](https://codelivly.com/rooms)