Threat Intelligence Lifecycle

Introduction

The Threat Intelligence Lifecycle is a systematic process that ensures the effective creation and management of intelligence. This module explores each phase in detail and how they work together to create actionable intelligence. You may see the model with less or more stages in it. They are all correct, I have used the one which displays the most phases to exapnd further. To avoidd confusion you will also see the Intelligence Lifecycle model with the following. (Direction, Collection, Analysis, Dissemination, Feedback)

Planning and Direction Phase Overview

Planning and Direction

This is the first phase of the lifecycle which focuses on defining intelligence requirements and planning the collection strategy, also this is really where we want to be setting out the high level objectives

Some things I think are important to consider at this stage and "get out of the way" first are what constraints could there be? For example, What role will the intelligence function take? Will it be to inform decisions or make decisions. Will it be able to meet its customers proposed needs due to legal, ethical or practical constraints? Who will/has the accountability and ownership of the intelligence funciton? Of course, all these questions can be easily answered by discussing them with the right stakeholders.

Customer requirements are generally broken down. Long terms directives, Medium term directives and short term directives, which we shal disuss later in this section.

The Direction phase is where intelligence operations begin. It involves identifying and prioritizing intelligence requirements to ensure that intelligence collection and analysis efforts are aligned with the organizational needs. There should be nothing random happening, it should all be planned effectively. All intelligence picked for collection should have an end purpose.

You will want to begin making sure you are able to get all the appropriate key stakeholders together. Direction initially will come from them ( The Customer) The customer(s) will be the ones consuming the intelligence. At this stage you will also define how the intelligence will be presented and disseminated.

It is important to note that sometimes the customer does not know what they need, or might think they need A but require B, or they may have a great understanding. It is our job as intelligence producers to understand the reasons for the requirement in the first place. We need to be able to elicit requirements and understand the customers mind set to better align with their goals.

To help us navigate this with a client we can use the MoSCoW method or something similar which will allow appropriate planning to take place with something that is well understood by most organisations. If you're not familiar with MoSCoW then check out this link This method helps intelligence teams rank PIRs based on their urgency, impact, and relevance. We can then use the SMART method to ensure that PIRs are well-defined, actionable, and measurable by making them

Understanding how customers consume and apply threat intelligence is essential for delivering actionable intelligence that aligns with their security operations, risk management strategies, and compliance requirements. Before mapping intelligence consumption, CTI teams must assess customer requirements, which vary based on industry, security maturity, and threat landscape.

Examples can be varying. But a few could be, a SOC analyst needs real-time tactical threat feeds to block active threats. a CISO needs strategic intelligence reports for board level risk assessments, or a Risk Manager required long-term trend analysis to inform security investments.

Different teams within an organization consume and apply threat intelligence differently. Intelligence must be structured to ensure it reaches the right people in the right format. We will discuss this a length in this section.

Understanding the Customer’s Security Position & Requirements

Before defining scope, CTI teams must assess the organization’s current threat landscape, security maturity, and intelligence needs. I like to do this by asking very basic questions, som examples below

Scoping the Intelligence Project to Achieve Key Outcomes

We will be delving into this topic in much more depth depth within this chapter. But for a quick overview we will cover some points below to get you thinking.

Accurate Timescale Scoping & Resource Planning

Effective threat intelligence projects require careful planning of time, personnel, and technical resources.

Defining Rules of Engagement, Limitations & Constraints

Rules of engagement (RoE) ensure CTI activities follow legal, ethical, and operational guidelines. Here are some considerations

Requirements Overview

Essential Elements of Information

(EEI) Essential Elements of Information help break down broad intelligence questions into specific and measurable data points.

Understanding how to define and apply EEIs effectively is a key skill for Cyber Threat Intelligence.

Essential Elements of Information (EEIs) are critical intelligence data points required to satisfy Priority Intelligence Requirements (PIRs) and guide threat intelligence collection efforts. They help intelligence teams focus on specific data sets that provide actionable insights.

In the context of Cyber Threat Intelligence (CTI), EEIs act as the building blocks that support both Explicit and Implicit Intelligence Requirements, ensuring intelligence teams collect only relevant, high-value information rather than overwhelming security teams with excessive, unstructured data.

Introduction to Priority Intelligence Requirements (PIRs)

Now we have broken down how requirements can be formed, we now need to create PIR's. Priority Intelligence Requirements. Fundementally we should now have a set of well thought out and understood requirements. The task now is to place these requirements in a an order of priority. Generally, as already mentioned, these can be broken down into Long-term, Medium-term and Short-terms requirements. The key here really is to understand that it's likely not all intelligence requirements can be met, nor sufficient data can be collected, so whilst choosing the priority we also have to fator in the practicality.

PIRs help intelligence teams prioritize data collection, focus analytical efforts, and align intelligence outputs with business and security objectives.

Requirements can come from interviews, questionairre's, Feedback, Observations, Bunsiness planning and a plethora of other means. The key really is to draft good intelligence requirements.

The Direction and Planning phase is essential for ensuring cyber threat intelligence (CTI) is effective, targeted, and valuable.

Without a clear direction, structured intelligence requirements, and effective planning, intelligence teams risk collecting irrelevant data, missing critical threats, and failing to support business security objectives. By implementing best practices in PIRs, EEIs, MoSCoW prioritization, and SMART refinement, organizations can ensure intelligence-driven security decision-making that proactively mitigates cyber risks.

Data collection in Cyber Threat Intelligence (CTI) is a critical process that must be efficient, agile, robust, and legally compliant. The ability to gather, validate, and analyze intelligence from both technical and human sources is fundamental to detecting, preventing, and mitigating cyber threats.

Some important things to consider: You cannot collect & monitor for everything! Therefore you need to find a balance and you will find yourself balancing the breadth against depth. Borad collection but shallow and detailed and narrow.

Collection Sources

Intelligence can come from many sources. Below we list the most common. It is important to note that depending on the souce you choose (of which could be multiple) then it is likely that one or more could change the dynaics of your intelligence collection. We will discuss legal frameworks later in this section, but for now it must be something you must factor in to your plan.

Raw data is transformed into a format suitable for analysis through various technical and manual processes.

The critical phase where processed data is converted into actionable intelligence through various analytical techniques.

The process of delivering intelligence products to stakeholders in an appropriate and timely manner.

The continuous improvement phase where stakeholder feedback is collected and incorporated into the process.