Module
The Intelligence Cycle
Five steps, and two of them are the ones everybody skips. Not a diagram to memorise: the list of places a threat intelligence effort can break, in the order you should check them.
50 min · Beginner
What you will learn
- Name the five steps of the threat intelligence cycle in order
- Write a requirement with a subject, a deadline and a decision on the end of it
- Choose sources against a requirement instead of by volume
- Say what to change when analysis runs out of raw material
- Take an effort that is not delivering and name the step that broke it
Lessons
The Step Everyone Skips
The cycle does not start with collecting. It starts with somebody saying what they want to know and what they will do about it.
Collection, and the Fire Hose
The step that eats the budget. Choosing sources against a written requirement instead of by volume.
The Loop That Bends
The diagram is a clean ring. The work is not. What to change when analysis runs out of raw material.
The Product Is the Format
Dissemination is not sending the report. Picking the form from the person who has to act on it.
Evaluation, or It Is a Line
The last step is the one that makes it a cycle, and the one that turns the model into a fault finder.