Intelligence Dissemination and Decision Support
Dissemination and Decision Support tests how intelligence reaches the right consumer and changes a decision. Expect product types, audience tailoring, bottom-line-up-front writing, confidence language, handling caveats such as TLP, recommendations, feedback, and measures of use.
Core rules
- Match the product to the need: flash reporting for urgent actionable threat, daily or weekly briefs for situational awareness, actor profiles for targeting context, campaign reports for defenders, threat assessments for planning, and intelligence estimates for strategic decisions.
- Tailor to the audience. Executives need risk, likelihood, business impact, and a decision. SOC analysts need detection logic and TTPs. Incident responders need infrastructure and behavior. The board needs strategic exposure and treatment options.
- Lead with the bottom line. Separate facts, assumptions, and judgments. State confidence and the 'so what' before supporting detail.
- Include recommended actions or decision points. A product that ends with data but no implication is incomplete.
- Apply handling caveats correctly. TLP:RED is recipient-only; TLP:AMBER is limited sharing within the organization and named partners; TLP:GREEN is community-wide; TLP:CLEAR is public. Mark source and handling on every product.
- Build feedback loops. Track requests for information, decisions taken, and whether the product was used.
Worked example
A SOC asks about a new ransomware campaign. A flash product states the bottom line: 'A ransomware affiliate is exploiting exposed VPN appliances to gain initial access, with moderate confidence.' It lists observed techniques, affected product versions, detection opportunities, and recommended immediate actions such as patching, MFA enforcement, and hunting for specific log patterns. It does not simply distribute a list of hashes. The product is marked TLP:AMBER and shared with the SOC and vulnerability management leads.
Traps that cost marks
- Dumping data without a bottom line or recommendation.
- Using the same product format for executives and technical responders.
- Overclassifying or misapplying TLP, which blocks legitimate use.
- Omitting confidence or implying certainty.
- Failing to capture feedback and decision outcomes.