Managing Intelligence Lifecycle

When to Use

Use this skill when:

• Establishing a formal CTI program and defining its operational model
• Conducting quarterly intelligence requirements reviews with business stakeholders
• Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)

Do not use this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.

Prerequisites

• Executive sponsorship and defined CTI team structure (1+ dedicated analysts)
• Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)
• Existing feed subscriptions or ISAC memberships for collection baseline
• CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management

Workflow