## The Threat Intel Lifecycle

Threat Intelligence (CTI) is knowledge about adversaries. It moves security from "What is hitting me?" to "Who is hitting me and why?"

### The Lifecycle
1.  **Planning & Direction**: The "Requirements".
    *   "We are a Bank. We care about Fin7 (Credit Card thieves). We don't care about APTs targeting Aerospace."
2.  **Collection**: Gathering raw data.
    *   Open Source (OSINT): Twitter, GitHub, Blogs.
    *   Closed Source: Vendor feeds (CrowdStrike, Mandiant), Deep Web forums.
    *   Technical: HoneyPots, Malware Sandboxes.
3.  **Processing**: Cleaning and normalizing.
    *   Converting a PDF report into a list of IPs (STIX format).
4.  **Analysis**: Making sense of it.
    *   "This new IP belongs to the same subnet used by Lazarus Group last year. It implies Lazarus is back."
5.  **Dissemination**: Sending it to the right people.
    *   **Strategic**: To the CISO ("Risk is elevated").
    *   **Tactical**: To the SOC ("Block these IPs").
6.  **Feedback**: "Was this useful?"

### Types of CTI
*   **Strategic**: High-level trends for Executives. ("Ransomware is up 200%").
*   **Operational**: TTPs for Hunters. ("They use PowerShell Empire").
*   **Tactical**: IOCs for SIEMs. (Hashes, IPs).