Threat Intelligence Lifecycle and Planning
This domain tests the order of the intelligence cycle, where each activity belongs, and how requirements are written. Scenario items often describe an activity and ask which phase it sits in, or ask you to critique a poorly written requirement.
The cycle
Planning and direction → collection → processing and exploitation → analysis and production → dissemination → feedback, returning to planning. CTI variants place requirements at the front and integration and feedback at the end. It is iterative, not a waterfall, and a break anywhere upstream degrades every later phase.
Planning and direction
- Identify stakeholders and the specific decisions they face.
- Elicit Priority Intelligence Requirements, then decompose into specific information requirements and essential elements of information that are actually collectable.
- Strong PIR: "Which ransomware affiliates targeted logistics firms in our region in the last six months, and what initial access vectors did they use?" Weak PIR: "Tell me about threats."
- Build a collection plan naming sources, frequency, owner, and escalation triggers.
- Define products, cadence, audience, format, handling rules and success criteria before collection starts.
Collection and processing
Collection executes the plan; processing normalises, deduplicates, enriches, scores and stores, so that analysis starts from clean data.
Analysis, dissemination, feedback
Analysis converts processed data into assessments with stated confidence and impact. Dissemination delivers the product in the form the consumer can act on. Feedback re-tunes the requirements; without it the cycle freezes and the programme drifts.
Governance and maturity
Keep a requirements catalogue, source register, product library and metrics: proportion of requirements answered, time from collection to dissemination, detections deployed per report. Maturity moves from reactive indicator consumption toward requirement-driven, integrated production.
Worked example
The head of IR issues a new requirement: "Are criminal groups exploiting our VPN vendor's new vulnerability, and how would we see it?" Reasoning: decompose - the specific requirement is whether exploitation has been observed in our region and sector; the essential element is post-exploitation commands and command-and-control infrastructure used. The collection plan assigns the vendor advisory and ISAC list to the analyst, internal VPN logs to the SOC, and forum monitoring to the research lead, with a weekly cadence. Only then does collection start. Skipping planning yields a pile of indicators that answers nothing.
Traps that cost marks
- Treating the cycle as one-way; feedback is a phase, not a courtesy.
- Collecting first and inventing requirements afterwards.
- Requirements phrased as topics rather than answerable questions.
- Confusing specific information requirements with the decision-level priority requirement.