Chapter 1: Cyber Threat Intelligence Life Cycle

This chapter will explain the steps of the threat intelligence life cycle. We will provide a high-level description of each step while looking at some practical examples to help you understand what each step entails. By the end of the chapter, you will be able to explain each stage of the intelligence life cycle and join the practical with the theoretical. This chapter forms the baseline of this book, and various intelligence strategies and processes will be built on top of this knowledge.

By the end of this chapter, you should be able to do the following:

• Clearly explain what cyber threat intelligence is, why organizations must integrate it into the business and security team, who benefits from it, and be able to define its scope.
• Understand the challenges related to threat intelligence and cybersecurity in general.
• Know and understand the required components to effectively plan and set directions for a threat intelligence project.
• Know and understand the data required to build an intelligence project and how to acquire it globally.
• Understand intelligence data processing, why it is essential in integrating a CTI project, and justify the need for automating the processing step.
• Understand the analysis step, its application, and its impact on the entire CTI project. In this step, you will also learn about intelligence analysis bias and different techniques that can be used to avoid a biased intelligence analysis.
• Explain the cycle's dissemination step and how to share an intelligence product with the relevant stakeholders. You should also understand the importance of the audience when consuming the product.
• Understand and explain the feedback phase of the cycle and state why it is critical in the project.

In this chapter, we are going to cover the following main topics:

• Cyber threat intelligence – a global overview
• Planning, objectives, and direction
• Intelligence data collection
• Intelligence data processing
• Intelligence analysis and production
• Threat intelligence dissemination
• Threat intelligence feedback