Cyber Threat Intelligence (CTI) reports describe adversary behavior and attack infrastructure in natural language but remain largely unstructured and difficult to process at scale. Existing CTI benchmarks are limited in realism or scope, often relying on synthetic or knowledge-base-derived data, coarse document-level annotations, or isolated subtasks. We introduce SMAH-CTI, a human-annotated benchmark derived from 100 public CTI reports from five threat intelligence providers. It contains 12,304 validated sentence-level instances annotated for (i) relevance classification, (ii) CTI-specific named entity recognition (NER), and (iii) multi-label MITRE ATT CK tactic, technique, and sub-technique mapping, together with grounded procedure descriptions. By unifying these tasks over evidence grounded in real CTI reports, SMAH-CTI provides a reproducible benchmark for evaluating structured CTI extraction and transforming unstructured reports into machine-interpretable intelligence.

This paper presents The_CyberEquity_Lab team’s participation in the FIGNEWS 2024 Shared Task (Zaghouani, et al., 2024). The task is to annotate a corpus of Facebook posts into bias and propaganda in covering the Gaza-Israel war. The posts represent news articles written in five different languages. The paper presents the guidelines of annotation that the team has adhered in identifying both bias and propaganda in coverage of this continuous conflict.