PIRs

Understanding the type of intelligence that is necessary and in what priority is a key focus of any CTI function. Not knowing what intelligence to collect and enrich is akin to a rudderless ship that is adrift at sea. PIRs help intelligence become more granular and well-defined by specifically answering several key intelligence questions.

PIRs are intelligence requirements that are defined by the organization, which have anticipated priorities in collection and enrichment to enable rapid decision-making. PIRs are meant to determine and outline the priority of intelligence requirements. PIRs are commonly changed or replaced entirely, as prioritization needs, GIRs, and the organization's threat profile change.

Good PIRs are always time-based and should ask singular questions, such as what are the threat actor's motives while attacking my organization? PIRs are often defined using a combination of GIRs, threat modeling, and red teaming, and they should be reevaluated...