## The Intelligence Cycle\n\nThe Intelligence Cycle is a systematic process with **six phases**:\n\n### 1. Direction (Planning)\nStakeholders define intelligence needs. What decisions will this support?\n\n### 2. Collection\nGather raw data from sources:\n- OSINT (social media, news, forums)\n- Technical (malware, network traffic)\n- Commercial feeds (Recorded Future, Mandiant)\n- Internal (SIEM, EDR, incident reports)\n\n### 3. Processing\nConvert data to usable format: decoding, normalizing, deduplication.\n\n### 4. Analysis\nThe core intellectual work: pattern recognition, link analysis, hypothesis testing.\n\n### 5. Dissemination\nDeliver to consumers in appropriate formats:\n- Executives → Strategic briefs\n- SOC Analysts → IOC lists, detection rules\n\n### 6. Feedback\nConsumers provide feedback to improve future intelligence.