The CTI process
As explained previously, there are some great resources that thoroughly define the process of CTI. Here, we will introduce it briefly with a concrete example.
CTI can be represented as a cycle that is composed of six steps:
Figure 3.1 – The CTI process
The CTI process can be described and explained as follows:
- The first step is to plan all of the steps required in the CTI process by defining the intelligence requirements and identifying the stakeholders (that is, the audience involved). This step is important to fully understand our organization's security context and needs, as it will drive the collection, processing, and analysis steps.
Example: We have identified that the CISO needs to understand the threat trends for our organization and also that our security operations center (SOC) manager needs to identify what detection rules must be prioritized within the SOC.
- With regard to the intelligence...
