With companies providing disinformation as a service (DaaS) and the US election coming up in November, we need to prepare our disinformation defences now more than ever. This talk is about how we set up and ran a real-time disinformation threat intelligence team inside a larger information security response - The CTI-League. It includes tools, processes, data science support and how to keep the team sane whilst reading dangerous materials.