← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 1: Start With the Decision

From Security Data to Intelligence

Learn the difference between observations, context, analysis, and decision support.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Classify examples as data, information, intelligence, or decision support and explain the transformation between them.

From Security Data to Intelligence

This lesson gives you a precise mental model for intelligence work. You will follow one fictional alert from raw event to defensible judgment and learn why more data does not automatically create better intelligence.

Four Layers of Meaning

A security event is not automatically intelligence. Data is an observation recorded by a system: a timestamp, domain, process name, login result, or alert. Information is data organized with context, such as a set of failed logins grouped by account and time. Analysis is the reasoned interpretation of that information. Intelligence is the resulting judgment prepared for a specific consumer and decision.

Consider a fictional company, Northstar Freight. Its identity platform records 214 failed logins against three accounts from one hosting provider in 18 minutes. That is useful information, but it does not prove an attack. The analyst still needs to ask whether the accounts were exposed, whether the source was a corporate VPN, whether successful logins followed, and what the business should do. Intelligence connects the evidence to a decision while keeping uncertainty visible.

Practice: Write one sentence for each layer using the Northstar example. If your sentence contains a conclusion at the data layer, move that conclusion into the analysis layer. This small discipline prevents assumptions from becoming facts.

Four layers from event to decision Four connected panels show data, information, analysis, and decision support as increasing levels of meaning. FROM EVENT TO ACTIONMeaning is built in layers DATA09:41:03203.0.113.8raw observation INFORMATION214 failures3 accounts / 18 minorganized context ANALYSISspray is plausibleconfidence: moderatereasoned judgment DECISIONreview exposurepreserve evidenceaction for a consumer The conclusion belongs after the evidence, not inside the observation.
Four layers from event to decision — A staged model separates raw observations, contextual information, analytic judgment, and decision support.

Intelligence Exists to Support a Choice

Intelligence is valuable because someone can use it. A report that lists interesting threats but never explains a decision is closer to a news digest than an intelligence product. Start by naming the consumer: an incident responder, SOC lead, vulnerability manager, executive, or product owner. Then identify the choice they need to make and the time available.

For Northstar Freight, an executive may need to decide whether to fund phishing-resistant authentication this quarter. The SOC lead may need to decide which identity telemetry to hunt today. Both consumers can use the same underlying evidence, but they need different products. The executive needs business impact, confidence, and investment options. The SOC lead needs observable behaviors, data sources, and a bounded hunt.

A useful test: remove the final recommendation from your draft. If the remaining text does not make clear who needed the answer and what decision it supports, the requirement is not ready. Intelligence should reduce uncertainty enough to improve a choice, not pretend to eliminate uncertainty entirely.

One evidence base, two decision productsA central evidence set branches into an executive decision product and a SOC investigation product. CONSUMER FITShape the product around the choice SHARED EVIDENCEidentity logs + source reports EXECUTIVE PRODUCTfund controls this quarterimpact + confidence + optionsSOC PRODUCTinvestigate activity todaybehavior + telemetry + hunt
One evidence base, two decision products — The same evidence is shaped differently for an executive funding decision and a SOC investigation.

Resources

Next: Write an Intelligence Requirement →