CTAS key terms

The short list of questions leadership most needs answered about threats, stated precisely enough to guide collection and analysis. PIRs focus effort and are reviewed regularly as decisions and threats change.

Documented statements of what decision-makers need to know, broken down into answerable questions. They connect strategy to collection and analysis, and each requirement should trace to a decision it informs.

Specific details that must be gathered to answer a broader intelligence requirement. EEIs translate an abstract question into observable facts, making collection tasks concrete and measurable.

The recurring sequence of planning and direction, collection, processing, analysis and production, and dissemination. Each stage feeds back into the others, so feedback and re-tasking are continuous rather than a single pass.

A staged framework describing how an organization progresses from ad hoc, reactive data gathering to automated, decision-driven intelligence. Stages typically emphasize process, automation, and measurable outcomes rather than tool count.

Identifying the people and teams who consume or act on intelligence, and what decisions each one owns. It ensures requirements and products match real decisions instead of generic curiosity.

A documented schedule of which sources and methods will answer which requirements, within what timeframe, and at what cost. It links requirements to sources and is updated as gaps and priorities shift.

A requirement that current sources cannot answer, or answer too slowly or unreliably. Explicitly recording gaps prevents false confidence and drives decisions to add sources or adjust expectations.

Intelligence derived from publicly available information such as websites, registries, news, and social media. It is inexpensive and broad but requires verification because public sources can be manipulated or stale.

A machine-readable stream of indicators such as hashes, domains, or IP addresses, often delivered by subscription. Feeds vary in quality and context, so ingestion should be filtered and scored before use.

An assessment of how trustworthy a source is, based on its history, access, and independence. Reliability is judged separately from whether a specific report from that source is accurate.

An assessment of how believable a particular piece of reporting is, given corroboration and plausibility. It is rated independently of the source's overall reliability, so a good source can still pass a doubtful report.

Confirming a claim using independent sources that did not simply copy one another. True corroboration requires separate origins; circular reporting can make a single rumor appear widely confirmed.

The discipline of tasking, tracking, and evaluating collection against requirements. It balances coverage, timeliness, and cost, and it feeds back when sources underperform or new needs emerge.

A trusted group of organizations that exchange threat data under agreed handling rules. Membership increases coverage but requires governance over what may be shared and how it is protected.

Formal methods such as key assumptions checks and analysis of competing hypotheses that reduce bias in judgment. They make reasoning auditable and help analysts challenge early conclusions before they harden.

A technique that lists plausible explanations, then evaluates evidence for consistency with each, seeking to disprove rather than confirm. It counters anchoring and confirmation bias by forcing alternatives to be considered.

Systematic patterns of judgment error, such as anchoring on the first report or seeking only confirming evidence. Naming and countering them with structured methods improves analytic accuracy.

A stated measure of how strongly evidence supports an analytic judgment, distinct from the likelihood of the event itself. Expressing both separately prevents readers from over-reading uncertain conclusions.

Standard wording, such as 'likely' or 'almost certain', mapped to defined numeric ranges. Consistent terms prevent readers from interpreting the same phrase differently across reports.

The concise, up-front statements of the most important analytic conclusions in a product. They give busy readers the bottom line first, with supporting detail following beneath.

An observable artifact, such as a file hash, domain, or IP address, that suggests malicious activity. IOCs are perishable because adversaries rotate infrastructure, so they need context and expiry.

A behavior or sequence of actions indicating an intrusion in progress, such as unusual credential use or lateral movement. IOAs are more durable than artifacts because they describe intent and technique.

A public knowledge base of adversary tactics and techniques observed in real intrusions, organized by goal. Analysts use it to map detections and coverage against known behavior.

The goals, methods, and specific operating patterns of an adversary. TTPs describe behavior rather than fixed artifacts, making them more stable and useful for detection and attribution.

An individual or group conducting malicious activity, often described by motivation, capability, and resources. Profiling actors helps predict targets and methods beyond isolated indicators.

Judging which actor is responsible for an activity, with an explicit confidence level. Attribution is often uncertain and should be presented with evidence and alternatives, not as settled fact.

A model of an intrusion as sequential stages, from reconnaissance through exploitation to actions on objectives. Defenders use it to find gaps and to interrupt attacks at the earliest feasible stage.

An analytic framework describing intrusions through four linked features: adversary, capability, infrastructure, and victim. It helps analysts pivot from one known element to related unknowns.

A finished deliverable, such as a report, brief, or feed, tailored to a specific audience and decision. Good products state the bottom line, evidence, confidence, and recommended action clearly.

Delivering intelligence to the right consumers in a usable form and timeframe, with handling rules attached. It closes the loop from requirement to decision and invites feedback for the next cycle.

A widely used marking scheme indicating how far information may be shared, from red (named recipients only) to clear (public). It governs onward sharing and must travel with the information.

Labels on intelligence specifying permitted recipients, storage, and reuse, beyond or alongside TLP. Clear markings protect sources and satisfy legal or contractual sharing obligations.

Ranking threats by combining likelihood, impact, and the organization's exposure and controls. It directs limited defensive effort toward the risks that most affect the mission.

A structured exercise identifying likely adversaries, attack paths, and assets at risk for a system or business process. Its outputs shape requirements and inform defensive investment.

The amount and type of risk leadership is willing to accept in pursuit of objectives. Intelligence assessments should be framed against it so recommendations align with tolerated exposure.

Defined measures showing whether the intelligence program delivers value, such as requirements answered or decisions influenced. Metrics should track outcomes, not merely volume of data collected.

The mechanism by which consumers report whether products were useful and accurate, feeding back into requirements and collection. Without it, programs drift from the decisions they exist to support.

An indicator or alert flagged as malicious that is actually benign, such as a shared hosting address. High false-positive rates erode analyst trust and waste response capacity.