Collection Sources and Collection Planning
What this domain tests
Collection sources and collection planning tests whether you can turn intelligence requirements into a deliberate collection plan, evaluate sources properly, and use internal and external data without crossing legal or ethical lines. Expect questions about source types, the Admiralty code, PIRs, and collection gaps.
Source types
- Internal telemetry: EDR, SIEM, DNS, proxy, identity logs, honeypots, phishing mailboxes, and past incident reports. It is often the most relevant and most overlooked source.
- Open source (OSINT): vendor research, CERT and government advisories, ISAC reports, code repositories, social media, forums, paste sites, and dark web markets. Accessible does not mean reliable.
- Commercial and community feeds: indicator feeds, malware sandboxes, scanning services, and enrichment APIs. They require tuning, deduplication, and context.
- Human sources (HUMINT) and technical sources (TECHINT) such as malware analysis and network scanning add depth but carry handling and legal obligations.
- Peer and sector sharing: ISACs, CERTs, and trust groups provide timely, contextualized reporting.
Collection planning
Start from priority intelligence requirements (PIRs) tied to a decision: what do we need to know, for whom, by when, and why? A collection plan should state the question, source, method, frequency, owner, legal basis, handling caveat, and success criterion. Use a source evaluation scheme: the Admiralty code rates source reliability (A–F) separately from information credibility (1–6). Corroborate important judgments across independent sources and record gaps. Collection management includes deconfliction, feedback, and retiring sources that no longer answer a requirement.
Worked example
A hospital group asks which actors are exploiting VPN appliances against healthcare. The PIR is narrow: actor targeting, exploited vulnerabilities, and observed post-exploitation. Collection includes government advisories (reliability A, credibility 2), an ISAC report (B2), a dark web forum post offering access (C3), and internal VPN logs. The forum post is not treated as fact; it is a lead. The plan assigns the SOC to review logs, the CTI analyst to corroborate vendor reporting, and legal to confirm handling of any patient data. The output is a short assessment with confidence and collection gaps.
Traps that cost marks
- Collecting because a feed is available rather than because a requirement exists.
- Confusing source reliability with information credibility.
- Treating a single vendor report as corroboration; reports often recycle the same source.
- Ignoring internal telemetry.
- Overlooking terms of service, privacy law, or sharing restrictions during collection.