producing-threat-intelligence

Producing Threat Intelligence

Intelligence is not a pile of indicators — it is analysis that reduces a decision-maker's uncertainty. An IOC with no context, no confidence, and no recommended action is data, not intelligence. Attribution is a claim you must be able to defend from evidence, not a guess dressed in a threat-actor name. The test of a finished product is simple: did someone decide something differently because of it?

When to Use

• Pivoting from a domain, IP, hash, TLS certificate, or registrant to related infrastructure
• Tracking a threat actor or campaign over time
• Enriching and contextualizing raw indicators into usable intelligence
• Producing a finished intelligence product for a defined consumer
• Assessing whether an external vendor or government report is relevant to your organization
• Building and curating a threat model of the adversaries that actually matter to you

When NOT to Use

• Searching your OWN telemetry for the activity — use hunting-threats
• Reversing a specific sample — use analyzing-malware
• Resolving an ATT&CK technique ID to a skill — use mapping-attack-techniques
• An active, confirmed incident — use responding-to-incidents
• Turning intel into deployed detection rules — use engineering-detections

The Intelligence Lifecycle

Every product moves through the same loop. Naming the stages is not bureaucracy — it is where you catch the two failures that make CTI worthless.

1. Direction     — whose decision, which question (a PIR)
2. Collection    — gather against the requirement, not everything reachable
3. Processing     — normalize, deduplicate, translate, enrich
4. Analysis      — assess, weigh hypotheses, assign confidence
5. Dissemination — deliver in a form the consumer can act on
6. Feedback      — did it help; refine the next requirement

The two failures that account for most wasted CTI effort are at the ends of the loop, not the middle:

• Skipping direction produces intelligence nobody asked for. Without a Priority Intelligence Requirement (PIR) naming the consumer and the decision, you collect what is easy and report what is interesting, and it lands on no one's desk. Start from the question, not the feed.
• Skipping dissemination produces analysis that never reaches a decision. A brilliant assessment sitting in a wiki nobody reads changed nothing. The product is not done when it is written; it is done when it is in front of the person who acts on it, in the form and at the time they need it.