Aduana Digital de Defensa Argentina
Create ADDA access
← ADDA Manual

intel/1.1.0 · updated Jul 9, 2026

Defensive intelligence

From isolated signals to a landscape: lists, maps, early warnings, and response packs.

The intelligence layer groups campaigns, suspicious infrastructure, and abuse patterns to provide context before a decision.

Before closing an incident, review watchlists, relationship maps, early warnings, and reports. That assessment avoids treating every case as entirely new.

Intel also helps prepare an external response: takedown packs, abuse reports, monitoring campaigns, and reusable materials for institutional coordination.

Checklist

  • • Review watchlists and the threat graph before responding to an incident.
  • • Issue an early warning when the pattern is repeatable and cross-cutting.
  • • Prepare a takedown pack if a campaign or infrastructure persists.

Quickstart

  1. 1. Move to intel when the finding already shows repetition or a campaign.
  2. 2. Use watchlists and reports to avoid starting from scratch in each case.
  3. 3. If an external response is needed, prepare a takedown or abuse report with context.

Operational flow

Group

Connect related domains, campaigns, actors, or infrastructure.

Move beyond the isolated-event view.

Anticipate

Issue watchlists or early warnings when the pattern may repeat.

Act before the damage escalates.

Respond externally

Prepare reports or packs if external coordination can reduce the active surface.

Connect local defense with institutional response.

flowchart LR
  S1["Group"]
  S2["Anticipate"]
  S3["Respond externally"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Validate the intel path

Articles and next steps for watchlists, warnings, and takedown.

Examples

Manual candidate for an intel finding

{
  "title": "Patrón recurrente para watchlist",
  "sourceType": "intel_report",
  "sourceRef": "report_demo_001",
  "summary": "La infraestructura imitadora se repite en múltiples campañas y conviene documentar criterio de escalado."
}

Links and references

APIs

  • /api/adda/v1/intel
  • /api/adda/v1/intel/watchlists
  • /api/adda/v1/intel/threat-graph
  • /api/adda/v1/intel/early-warning

Docs and supporting routes

  • docs/ADDA_INTEL.md
  • docs/ADDA_API.md

Common issues

  • • Keeping intelligence outside the operational circuit turns it into decorative context.
  • • Issuing warnings without shared criteria can create institutional noise.

Suggested actions

  • • Use intel to explain repetition and prioritize response, not merely to store context.
  • • Connect intel to incidents, reports, and manual candidates when new learning emerges.

Useful reason codes

Score dictionary

severity

Institutional priority of the signal on the ADDA scale.

action

Next operational step recommended by the engine.

reasonCodes

Explainable reasons that justify the assessment.

Protocol notes

  • • Defensive intelligence is valuable for its ability to anticipate and coordinate.

Article history

Jul 9, 2026

Strengthened the use of intel as a bridge to external response and learning.