diff --git a/misp-galaxy-format/raw.md b/misp-galaxy-format/raw.md
index 2cf9307..85f51fe 100644
--- a/misp-galaxy-format/raw.md
+++ b/misp-galaxy-format/raw.md
@@ -193,7 +193,7 @@ Example use of the source-uuid, target-uuid fields in the mitre-enterprise-attac
 }
 ~~~~
 
-cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident and cfr-target-category **MAY** be used to report information gathered from CFR's (Council on Foreign Relations) Cyber Operations Tracker.  cfr-suspected-victims is represented as an array containing one or more strings and **SHALL** be present. cfr-suspected-state-sponsor is represented as a string and **SHALL** be present. cfr-type-of-incident is represented as a string and **SHALL** be present. cfr-target-category is represented as an array containing one or more strings ans **SHALL** be present.
+cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident and cfr-target-category **MAY** be used to report information gathered from CFR's (Council on Foreign Relations) [@?CFR] Cyber Operations Tracker.  cfr-suspected-victims is represented as an array containing one or more strings and **SHALL** be present. cfr-suspected-state-sponsor is represented as a string and **SHALL** be present. cfr-type-of-incident is represented as a string and **SHALL** be present. cfr-target-category is represented as an array containing one or more strings ans **SHALL** be present.
 
 Example use of the cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category fields in the threat-actor galaxy:
 ~~~~
@@ -265,5 +265,12 @@ of open standards in threat intelligence sharing.
   </front>
 </reference>
 
+<reference anchor='CFR' target='https://www.cfr.org/interactive/cyber-operations'>
+  <front>
+     <title>Cyber Operations Tracker - Council on Foreign Relations</title>
+     <author initials='' surname='CFR' fullname='Council on Foreign Relations'></author>
+     <date year="2018"></date>
+  </front>
+</reference>
 
 {backmatter}