Threat Intelligence Operations and Reporting
The Operations and Reporting domain tests whether you can run the intelligence cycle on a schedule and produce products that change decisions.
The operational cycle
Direction, collection, processing, analysis, dissemination, feedback. Operations means running that cycle with named owners and a cadence, not ad hoc research. Maintain a PIR log, an RFI queue and a product calendar: daily tactical, weekly operational, quarterly strategic.
Writing products that get read
Lead with the bottom line up front: judgment first, evidence second. Keep confidence separate from probability - "likely" is a probability estimate; "high confidence" describes the strength of sourcing. ODNI-style terms (almost no chance, very unlikely, unlikely, roughly even chance, likely, very likely, almost certain) keep language consistent. Map to ATT&CK, give indicators with context and a TTL, and mark handling with TLP 2.0: CLEAR, WHITE, GREEN, AMBER, AMBER+STRICT, RED.
Worked example
A new loader appears in three intrusions against your sector. BLUF: "The actor tracked as X is likely to deploy loader Y against VPN edge devices within 30 days; moderate confidence." Evidence: two ISAC reports, one vendor analysis, one internal honeypot hit. Confidence is moderate, not high, because the vendor report is uncorroborated. Include ATT&CK T1190 and T1059, file hashes, C2 domains with a 14-day TTL, and TLP:AMBER for the ISAC channel.
Traps that cost marks
Burying the conclusion under background, conflating confidence with likelihood, defaulting to TLP:RED (which destroys sharing), shipping indicators without TTL or context, and never measuring whether the intelligence changed a decision.
Feedback and metrics
Track intel-driven detections, time from indicator publication to block, false positive rate and RFIs answered on time. Feedback is a lifecycle stage, not a courtesy.