Threat › Module 2 › Lesson 2
Intel Lifecycle
Intel lifecycle literacy names planning, collection, processing, analysis, dissemination, and feedback — map stages on YOUR $TI_LAB workflow notes.
Visual · t33_intel_lifecycle
Intel lifecycle literacy. $TI_LAB only. Original Cyberlium.
Opening
Intel is a process, not a download — literacy teaches lifecycle stages so you govern collection and sharing on lab workflows you document.
The intelligence cycle: requirements and planning define what you need; collection gathers data from authorized sources; processing normalizes raw data; analysis produces assessed intel; dissemination shares to consumers; feedback refines requirements. Skipping planning yields noise; skipping feedback yields stale priorities. Cyberlium maps lifecycle stages on YOUR $TI_LAB — paper workflow with fictional lab IOC source at collection stage. Next: Consumers Named.
1. Lifecycle stages (named)
Planning: define intelligence requirements and priority questions. Collection: gather from authorized feeds, OSINT, internal logs — lab IOC files on $TI_LAB. Processing: parse, deduplicate, format STIX. Analysis: assess confidence, attribute, map TTPs. Dissemination: deliver to SOC, hunt, leadership. Feedback: did consumers act? refine requirements.
On $TI_LAB, sketch lifecycle with one fictional lab IOC moving from collection to dissemination.
Command guide
Try these commands — Lifecycle stages (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework CISA — https://www.cisa.gov/topics/cyber-threats-and-advisories FIRST — https://www.first.org/global-sigs/trusted-introducer
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/notes/intel-lifecycle.md" <<'EOF'
# Intelligence Cycle — YOUR org notes
1. **Planning & Direction** — define intel requirements (what decisions need data?)
2. **Collection** — authorized sources: ISACs, vendor feeds, internal logs, OSINT hygiene
3. **Processing** — normalize IOC formats, dedupe, enrich with ATT&CK context
4. **Analysis & Production** — assess confidence, write actionable reports
5. **Dissemination** — share to SOC, IR, leadership via approved channels
6. **Feedback** — tune requirements; retire stale IOCs
Lab: document cycle with YOUR fake IOCs — no criminal collection
EOFCommand — copy this
grep -E 'Planning|Collection|Dissemination' "$TI_LAB/notes/intel-lifecycle.md"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); CISA (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST (https://www.first.org/global-sigs/trusted-introducer). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lifecycle beats 'download and pray'
Unplanned collection floods analysts with low-value IOCs. Missing feedback loops leave requirements stale after incidents. Mature TI teams document requirements before subscribing to feeds.
Students practice lifecycle mapping on lab notes — employer prod feed changes need ticket and consumer review.
3. Literacy ≠ unauthorized collection at any stage
Forbidden: criminal marketplace as collection source without legal authorization. Allowed: lifecycle card — six stages with $TI_LAB fictional lab IOC example at each relevant step.
Ship: intel lifecycle card for YOUR lab workflow. Next: Consumers Named.
4. What you ship: intel lifecycle card for $TI_LAB
Six stages with fictional lab IOC flow. $TI_LAB named. NO criminal collection. chmod 600.
5. What you record before the next lesson
Date. Lifecycle card. $TI_LAB named. File t33-m02-l02-intel-lifecycle.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Subscribe to every feed without requirements. Skip feedback after sharing lab IOCs.
Right
Write intel lifecycle card for YOUR $TI_LAB. Next: Consumers Named.
Mission: map intel lifecycle on YOUR lab
1) List six lifecycle stages. 2) Trace one fictional lab IOC through collection to dissemination. 3) Write one feedback question for consumers. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Requirements before feeds — lifecycle planning saves analyst burnout.
Knowledge Check
APPLY: Collection stage gathers data from:
Multiple choice
Knowledge Check
APPLY: True or False: Feedback stage refines intelligence requirements based on consumer needs.
True or False
Knowledge Check
APPLY: Intel lifecycle literacy on Cyberlium avoids:
Multiple choice