CTI Cycle.

Planning and Direction

The first step of the cycle involves determining which threats need to be monitored, which data are relevant, and which adversaries pose the greatest risk to the organization. This stage is based on intelligence requirements (PIRs - Priority Intelligence Requirements) and may include:

• Identification of critical assets that require protection.
• Definition of key threat actors (APT groups, cybercriminals, hacktivists).
• Mapping of adversaries’ tactics, techniques, and procedures (TTPs).
• Establishing relevant indicators of compromise (IOCs).

Tools used: MITRE ATT&CK, Threat Modeling, Open Source Intelligence (OSINT), analysis of previous incidents.

Data Collection

In this phase, the intelligence team gathers raw data from various internal and external sources. Collection can be active (direct engagement with sources) or passive (monitoring open sources). The main sources include:

• Threat Intelligence feeds (AlienVault OTX, VirusTotal, MISP).
• Dark Web and Deep Web (clandestine markets, hacker forums, Telegram).
• Malware analyses and network traffic (sandboxing, dynamic/static analysis).
• Intelligence reports (FBI, CISA, FireEye, CrowdStrike).
• Honeypots and digital traps to capture adversary behavior.

Challenge: The large volume of collected data must be filtered and prioritized, as not all information is relevant to the organization.

Processing

After collection, the raw data must be transformed into a structured format to facilitate analysis. This processing may involve:

• Normalization of logs and event correlation.
• Extraction and categorization of IOCs (IPs, hashes, domains, malicious URLs).
• Conversion of unstructured data (texts, PDFs, emails) into useful information.
• Automation with SIEM/SOAR to correlate suspicious events.

Technologies used: Elastic Stack (ELK), Splunk, MISP, YARA Rules, Python for automation.

Analysis and Production

In this phase, analysts interpret the processed data to understand attack patterns, attribute threats, and assess potential impacts. Some approaches include:

TTP Analysis: Mapping attacks based on the MITRE ATT&CK framework.
Adversary Attribution: Identifying APT groups through their unique techniques.
Threat Trends: Detecting emerging attack patterns.
Machine Learning: Modeling anomalous behavior for early detection.

The outcome of this stage is technical reports and actionable intelligence that are disseminated to security stakeholders.

Intelligence Dissemination

Intelligence must be delivered to stakeholders in a clear and structured manner. Depending on the target audience, the format may vary:

For SOC and Blue Team: Detection rules (YARA, Sigma, Snort), updated IOCs.
For Executives and CISOs: Strategic reports on risks and financial impacts.
For DevSecOps: Indicators of vulnerabilities for proactive remediation.

Best practices: Use TLP (Traffic Light Protocol) to define sharing restrictions on intelligence.

Action and Response

With intelligence disseminated, it is time to act! Actions may include:

• Enhancing SIEM detections and adjusting firewall rules.
• Conducting threat hunting based on identified TTPs.
• Creating rapid response playbooks for future incidents.

Intelligence without action is worthless! Effective implementation of countermeasures is essential to reduce risk.