What is the threat intelligence lifecycle?
The threat intelligence lifecycle, also called the intelligence cycle, is the repeating process a threat intelligence program follows to turn questions into answers people can act on. It is usually described in six stages: direction, collection, processing, analysis, dissemination and feedback.
The six stages
- Direction. Decide what you need to know, written as priority intelligence requirements.
- Collection. Gather data from feeds, open sources, dark web sources, sharing communities and your own incidents.
- Processing. Normalize, deduplicate, translate and score the raw data so it can be analyzed.
- Analysis. Interpret it: who is behind the activity, what they want and what it means for you, with a stated confidence.
- Dissemination. Deliver the result in the form each audience needs, from automated indicators for tools to bulletins and briefings for people.
- Feedback. Learn what was useful and adjust requirements and sources.
Where does the lifecycle usually break?
- No direction, so collection grows without purpose.
- Processing bottlenecks, where analysts spend their time cleaning data instead of analyzing it. Automation and a TIP help here.
- Dissemination that doesn't reach operations, such as reports nobody in the SOC reads. See automated integration.
- Missing feedback, so the program never learns which sources matter.
Frequently asked questions
Is the threat intelligence lifecycle the same as threat intelligence management?
They are closely related. The lifecycle describes the stages of producing intelligence. Threat intelligence management is the practice of running intelligence through those stages well.
How long does one cycle take?
It varies from minutes, for automated indicator handling, to weeks, for strategic assessments. Most programs run many cycles at once.
Anomali and Threat Intelligence Lifecycle
Anomali ThreatStream Next-Gen automates collection, processing and dissemination, so analysts can spend more of the cycle on analysis.
See ThreatStream Next-Gen or request a demo.
Read next