Managing Intelligence Lifecycle

---
name: managing-intelligence-lifecycle
description: Use when manages the end-to-end cyber threat intelligence lifecycle from
  planning and direction through collection, processing, analysis, dissemination,
  and feedback to ensure intelligence products meet stakeholder requirements and continuously
  improve. Use when establishing or maturing a CTI program, defining intelligence
  requirements with business stakeholders, or building feedback loops between intelligence
  consumers and producers.
domain: cybersecurity
tags:
- CTI
- intelligence-lifecycle
- PIR
- NIST-SP-800-150
- threat-intelligence-program
- NIST-CSF
subdomain: threat-intelligence
version: 1.0.0
author: oyi77
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
category: cybersecurity
---

# Managing Intelligence Lifecycle

## Overview

Cybersecurity skill for managing intelligence lifecycle. Follows industry best practices and security standards.

## When to Use

**Trigger phrases:**
- "managing intelligence lifecycle"
- "Establishing a formal CTI program and defining its operational model"
- "Conducting quarterly intelligence requirements reviews with business stakeholder"
- "Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG ma"


Use this skill when:
- Establishing a formal CTI program and defining its operational model
- Conducting quarterly intelligence requirements reviews with business stakeholders
- Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)

**Do not use** this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites

- Executive sponsorship and defined CTI team structure (1+ dedicated analysts)
- Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)
- Existing feed subscriptions or ISAC memberships for collection baseline
- CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Define Objectives** — Clarify the goals and scope for intelligence lifecycle.
2. **Gather Resources** — Collect tools, data, and access needed for intelligence lifecycle.
3. **Execute Process** — Carry out intelligence lifecycle operations methodically.
4. **Verify Quality** — Check results against acceptance criteria.
5. **Document Outcomes** — Record findings, decisions, and next steps.

## Tools

- **Analysis Platform** — Data processing and visualization
- **Collaboration Tools** — Team coordination and knowledge sharing


## Process

1. **Scope** — Define research questions, identify data sources, set time boundaries
1. **Gather** — Collect data from primary sources, APIs, and public records
1. **Synthesize** — Analyze findings, identify patterns, produce actionable report

## Verification

- [ ] All intelligence lifecycle procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |