## The Intelligence Cycle

Intelligence does not just "happen." It is the result of a rigorous, repeatable process called the **Intelligence Cycle**. This 6-step loop ensures that the intel produced effectively meets the needs of the consumer.

---

### Phase 1: Direction (Planning)
This is the most critical phase. Before you collect a single log, you must ask: **"What do we want to know?"**
*   **Defining Requirements**: We create **Intelligence Requirements (IRs)**.
    *   *Bad IR*: "Tell me about hackers." (Too vague).
    *   *Good IR*: "Is our organization vulnerable to the specific ransomware strains currently targeting the healthcare sector?"
*   **Stakeholders**: Who needs this? The CISO? The SOC? The Patch team?

### Phase 2: Collection
Gathering the raw data to answer the question.
*   **Internal Sources**: Firewall logs, EDR telemetry, SIEM events, past incident reports.
*   **External Sources (OSINT)**: Twitter, Github, News reports, Pastebin.
*   **Closed Sources**: Dark web forums, paid vendor feeds (e.g., CrowdStrike, Mandiant), ISACs (Information Sharing and Analysis Centers).

### Phase 3: Processing
Raw data is often unusable (messy, encrypted, or foreign language). Processing turns it into a readable format.
*   **Normalization**: Converting 10 different log formats into one standard (like JSON or STIX).
*   **Translation**: Translating Russian forum posts into English.
*   **Decryption**: Decrypting malware configs.
*   **Filtering**: Throwing away the noise (false positives) to focus on the signal.

### Phase 4: Analysis
This is the "Brain" of the operation. Analysts connect the dots.
*   **Correlation**: "We saw this file hash in our network, and this report says it belongs to APT28."
*   **Attribution**: "Based on the TTPs, we assess with High Confidence this is a state-sponsored attack."
*   **Assessment**: "What does this mean for us?" The analyst validates the truthfulness of the data and estimates the potential impact.
*   **Structured Analytic Techniques (SATs)**: Methods like "Analysis of Competing Hypotheses" are used to avoid cognitive biases (like Confirmation Bias).

### Phase 5: Dissemination
Delivering the finished product to the right person, in the right format, at the right time.
*   **Strategic**: A 1-page PDF summary for the CEO. (No technical jargon).
*   **Tactical**: A machine-readable list of IOCs (STIX/TAXII) pushed directly to the Firewall.
*   **Operational**: A detailed report on TTPs for the Threat Hunting team.
*   **Rule of Thumb**: "The right intel to the wrong person is useless."

### Phase 6: Feedback
The cycle closes. Did we answer the question?
*   "Was this report helpful?"
*   "Did it lead to a detection?"
*   "Was it too late?"
*   Based on feedback, we adjust our **Direction** for the next cycle. If the SOC says "These IOCs were all false positives," we need to change our Collection or Analysis phase.

---

### Summary
The cycle never stops. As threats evolve, our requirements change, and the wheel keeps turning.