D8 · CySA+

What is the threat intelligence cycle?

TI cycle: Direction (define requirements) → Collection (gather raw data) → Processing (normalize/enrich) → Analysis (produce intelligence) → Dissemination (share with consumers) → Feedback.
Raw data is not intelligence — it requires analysis. Intelligence is actionable. The cycle is continuous — feedback improves future collection. Different consumers need different formats: executives = strategic, SOC = technical IoCs, IR teams = tactical TTPs.
← Back to Glossary Practice Questions →