Managing Intelligence Lifecycle
When to Use
Use this skill when:
- Establishing a formal CTI program and defining its operational model
- Conducting quarterly intelligence requirements reviews with business stakeholders
- Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)
Do not use this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.
Prerequisites
- Executive sponsorship and defined CTI team structure (1+ dedicated analysts)
- Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)
- Existing feed subscriptions or ISAC memberships for collection baseline
- CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management
Workflow
Step 1: Planning and Direction
Define Priority Intelligence Requirements (PIRs) with stakeholders:
- Interview SOC leads, IR team, CISO, risk management, and product security
- Document PIRs in structured format: "What is the current capability and intent of [threat actor] to attack [critical asset] using [technique]?"
- Prioritize 5–10 PIRs for the quarter, reviewed monthly
Example PIR: "Is ransomware group Cl0p currently targeting organizations in our sector using MoveIT or GoAnywhere vulnerabilities?"
Step 2: Collection Planning
Map PIRs to required collection sources:
- Technical sources: commercial feeds, TAXII, ISAC data, honeypot telemetry, darkweb monitoring
- Human sources: vendor threat briefings, industry working groups, law enforcement partnerships
- Internal sources: SIEM logs, EDR telemetry, phishing submission mailbox
Document collection gaps and associated costs to fill them.
Step 3: Processing and Normalization
Implement automated processing pipeline:
- Ingest → normalize to STIX 2.1 → deduplicate → enrich → score confidence
- Reject unverifiable or duplicate indicators before analysis
- Tag all processed data with source, collection date, and expiration
Step 4: Analysis and Production
Produce intelligence at three levels:
- Strategic: Quarterly threat landscape report for executives; sector trends, geopolitical context
- Operational: Weekly campaign reports for security leadership; active campaigns, adversary activity
- Tactical: Daily IOC bulletins for SOC; actionable indicators with block/monitor recommendations
Apply structured analytic techniques: Analysis of Competing Hypotheses (ACH), Key Assumptions Check, Devil's Advocacy.
Step 5: Dissemination
Match product format to audience:
- Executives: 1-page PDF with risk ratings, business impact, recommended decisions
- SOC analysts: SIEM-ready IOC list, Sigma rules, MISP events
- Vulnerability management: CVE lists with EPSS scores and exploitation likelihood
- IT/Security leadership: Full intelligence report with technical appendix
Apply TLP classifications and distribution lists per product type.
Step 6: Feedback and Evaluation
Collect feedback within 5 business days of dissemination:
- Did the product address the PIR?
- Was actionability sufficient?
- What data was missing?
Track metrics quarterly: PIR coverage rate, IOC true positive rate, time-to-disseminate, stakeholder satisfaction score (NPS or structured survey).
Key Concepts
| Term |
Definition |
| PIR |
Priority Intelligence Requirement — specific, actionable question driving intelligence collection and analysis |
| Intelligence Lifecycle |
Six-phase iterative process: Planning → Collection → Processing → Analysis → Dissemination → Feedback |
| Strategic Intelligence |
Long-term threat trend analysis for executive decision-making; time horizon 6–24 months |
| Operational Intelligence |
Campaign-level analysis for security program decisions; time horizon 1–6 months |
| Tactical Intelligence |
Specific IOCs and TTPs for immediate detection and blocking; time horizon hours to days |
| FIRST CTI-SIG |
Forum of Incident Response and Security Teams — CTI Special Interest Group maturity model |
Tools & Systems
- ThreatConnect: TIP with built-in intelligence lifecycle workflows, PIR tracking, and stakeholder reporting dashboards
- MISP: Open-source TIP supporting intelligence lifecycle from collection through sharing
- OpenCTI: Graph-based CTI platform with workflow management for intelligence products
- Recorded Future: Commercial platform with structured intelligence reports aligned to the intelligence lifecycle
Common Pitfalls
- Collection without direction: Ingesting every available feed without PIRs produces data overload and no actionable intelligence.
- Missing feedback loops: Without structured feedback, CTI teams produce reports that don't meet stakeholder needs and lose organizational relevance.
- Tactical-only focus: Overemphasis on IOC sharing neglects strategic intelligence that informs security investment and risk decisions.
- No metrics program: Cannot demonstrate CTI program value without tracking detection contributions, true positive rates, and stakeholder satisfaction.
- Underfunded collection: PIRs cannot be answered without appropriate collection sources; document and escalate gaps rather than producing low-confidence estimates.
1---2name: managing-intelligence-lifecycle3description: Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.4license: Apache-2.05---6# Managing Intelligence Lifecycle
7
8## When to Use
9
10Use this skill when:
11- Establishing a formal CTI program and defining its operational model
12- Conducting quarterly intelligence requirements reviews with business stakeholders
13- Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)
14
15**Do not use** this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.
16
17## Prerequisites
18
19- Executive sponsorship and defined CTI team structure (1+ dedicated analysts)
20- Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)
21- Existing feed subscriptions or ISAC memberships for collection baseline
22- CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management
23
24## Workflow
25
26### Step 1: Planning and Direction
27
28Define Priority Intelligence Requirements (PIRs) with stakeholders:
29- Interview SOC leads, IR team, CISO, risk management, and product security
30- Document PIRs in structured format: "What is the current capability and intent of [threat actor] to attack [critical asset] using [technique]?"
31- Prioritize 5–10 PIRs for the quarter, reviewed monthly
32
33Example PIR: "Is ransomware group Cl0p currently targeting organizations in our sector using MoveIT or GoAnywhere vulnerabilities?"
34
35### Step 2: Collection Planning
36
37Map PIRs to required collection sources:
38- Technical sources: commercial feeds, TAXII, ISAC data, honeypot telemetry, darkweb monitoring
39- Human sources: vendor threat briefings, industry working groups, law enforcement partnerships
40- Internal sources: SIEM logs, EDR telemetry, phishing submission mailbox
41
42Document collection gaps and associated costs to fill them.
43
44### Step 3: Processing and Normalization
45
46Implement automated processing pipeline:
47- Ingest → normalize to STIX 2.1 → deduplicate → enrich → score confidence
48- Reject unverifiable or duplicate indicators before analysis
49- Tag all processed data with source, collection date, and expiration
50
51### Step 4: Analysis and Production
52
53Produce intelligence at three levels:
54- **Strategic**: Quarterly threat landscape report for executives; sector trends, geopolitical context
55- **Operational**: Weekly campaign reports for security leadership; active campaigns, adversary activity
56- **Tactical**: Daily IOC bulletins for SOC; actionable indicators with block/monitor recommendations
57
58Apply structured analytic techniques: Analysis of Competing Hypotheses (ACH), Key Assumptions Check, Devil's Advocacy.
59
60### Step 5: Dissemination
61
62Match product format to audience:
63- Executives: 1-page PDF with risk ratings, business impact, recommended decisions
64- SOC analysts: SIEM-ready IOC list, Sigma rules, MISP events
65- Vulnerability management: CVE lists with EPSS scores and exploitation likelihood
66- IT/Security leadership: Full intelligence report with technical appendix
67
68Apply TLP classifications and distribution lists per product type.
69
70### Step 6: Feedback and Evaluation
71
72Collect feedback within 5 business days of dissemination:
73- Did the product address the PIR?
74- Was actionability sufficient?
75- What data was missing?
76
77Track metrics quarterly: PIR coverage rate, IOC true positive rate, time-to-disseminate, stakeholder satisfaction score (NPS or structured survey).
78
79## Key Concepts
80
81| Term | Definition |
82|------|-----------|
83| **PIR** | Priority Intelligence Requirement — specific, actionable question driving intelligence collection and analysis |
84| **Intelligence Lifecycle** | Six-phase iterative process: Planning → Collection → Processing → Analysis → Dissemination → Feedback |
85| **Strategic Intelligence** | Long-term threat trend analysis for executive decision-making; time horizon 6–24 months |
86| **Operational Intelligence** | Campaign-level analysis for security program decisions; time horizon 1–6 months |
87| **Tactical Intelligence** | Specific IOCs and TTPs for immediate detection and blocking; time horizon hours to days |
88| **FIRST CTI-SIG** | Forum of Incident Response and Security Teams — CTI Special Interest Group maturity model |
89
90## Tools & Systems
91
92- **ThreatConnect**: TIP with built-in intelligence lifecycle workflows, PIR tracking, and stakeholder reporting dashboards
93- **MISP**: Open-source TIP supporting intelligence lifecycle from collection through sharing
94- **OpenCTI**: Graph-based CTI platform with workflow management for intelligence products
95- **Recorded Future**: Commercial platform with structured intelligence reports aligned to the intelligence lifecycle
96
97## Common Pitfalls
98
99- **Collection without direction**: Ingesting every available feed without PIRs produces data overload and no actionable intelligence.
100- **Missing feedback loops**: Without structured feedback, CTI teams produce reports that don't meet stakeholder needs and lose organizational relevance.
101- **Tactical-only focus**: Overemphasis on IOC sharing neglects strategic intelligence that informs security investment and risk decisions.
102- **No metrics program**: Cannot demonstrate CTI program value without tracking detection contributions, true positive rates, and stakeholder satisfaction.
103- **Underfunded collection**: PIRs cannot be answered without appropriate collection sources; document and escalate gaps rather than producing low-confidence estimates.
theheavenlyd3mon