producing-threat-intelligence

Producing Threat Intelligence

Intelligence is not a feed of indicators — it is an answer to a question someone is going to make a decision on. A list of 400 IPs with no confidence, no sourcing, and no "so what" is data; it becomes intelligence only when it is tied to a requirement, graded for reliability, and written so the reader knows what to do and how much to trust it. The two failure modes are equal and opposite: shipping raw IOCs as if they were analysis, and shipping confident attribution the evidence does not support. This skill exists to avoid both.

This is an Advisory skill — it produces products, it does not touch targets. But collection has OPSEC: interacting with adversary infrastructure, or uploading a sample or URL to a public enrichment service, can tip off the actor and can expose engagement data. Treat every collection action as potentially observable.

When to Use

• Packaging IOCs and TTPs from an investigation into a finished intel product
• Enriching and grading indicators (IP, domain, URL, hash) before they are actioned
• Tracking a threat actor or campaign and building an actor profile from OSINT
• Defining Priority Intelligence Requirements (PIRs) and a collection plan
• Standing up or maturing a CTI program and its dissemination workflow

When NOT to Use

• Searching your own telemetry for compromise — use hunting-threats; a hunt consumes intelligence, this skill produces it
• Working an alert to a disposition — use triaging-security-alerts
• Writing a detection from the TTPs — use engineering-detections, writing-sigma-rules, writing-yara-rules
• Running or documenting a live incident — use responding-to-incidents
• Navigating work by ATT&CK technique — use mapping-attack-techniques
• Writing up a pentest/audit finding — use reporting-security-findings; an intel product is a different genre from a vulnerability report

The Intelligence Cycle

Run the loop; do not skip to collection because it feels productive.