← Introduction to Cyber Threat Intelligence
Module 1: The Basics of CTI
What is Intelligence? Why CTI Matters: Proactive Defense
Module 2: The Intelligence Cycle
Planning, Direction, and Collection Processing, Analysis, and Dissemination
Module 3: Types of Intelligence
Strategic, Operational, and Tactical CTI
Module 2: The Intelligence Cycle

Planning, Direction, and Collection

Discover how CTI teams define their requirements and gather raw data.

In this lesson, you will learn to:

  • Explain how intelligence requirements are generated and how data is collected to fulfill them.

Planning, Direction, and Collection

A look at the first two phases of the Intelligence Cycle.

Setting the Course: Planning and Direction

Imagine setting sail across the ocean without a map, a compass, or a destination. That is exactly what conducting intelligence operations without a plan feels like. The first phase of the Intelligence Cycle, Planning and Direction, is where we define our destination.

Before analysts look at a single piece of data, they must ask: What problem are we trying to solve? This phase is entirely driven by the needs of the decision-makers - whether that is a CISO wanting to know about new ransomware groups targeting their industry, or a network defender needing indicators of compromise for a recent vulnerability.

These needs are formalized into what we call Intelligence Requirements (IRs). Think of IRs as the guiding questions that keep an intelligence team focused. Without them, teams can easily get lost in the endless sea of internet noise, chasing exciting but irrelevant threats while missing the ones that actually endanger their organization.

A requirement compass keeps collection on courseConsumer, decision, timeframe, and priority define what the intelligence team must learn before it starts gathering data.INTRODUCTION TO CYBER THREAT INTELLIGENCEA requirement compass keeps collection on courseWHAT MUSTWE KNOW?intelligence requirementCONSUMERTIMEFRAMEDECISIONPRIORITYDIRECTION RECORDConsumer: incident commanderDecision: isolate finance systems?Deadline: before next business dayScope: admin portal + identity logsPriority: immediateCOLLECT ONLY WHAT SERVES THE CHOICEPlanning, Direction, and Collection
A requirement compass keeps collection on course — Consumer, decision, timeframe, and priority define what the intelligence team must learn before it starts gathering data.

Gathering the Raw Materials: Collection

Once we know what questions we need to answer, we enter the Collection phase. This is where we gather the raw materials needed to build our intelligence product.

If Planning is drawing the map, Collection is gathering the supplies for the journey. But where do we find these supplies? Data can be collected from a myriad of sources:

  • Internal Networks: Logs, alerts, and incident reports from inside your own organization.
  • Open Source Intelligence (OSINT): Publicly available information such as news articles, security blogs, and social media.
  • Closed Sources: Subscription feeds, private intelligence sharing communities, or dark web forums.

The key takeaway here is that during the collection phase, we are not analyzing. We are simply casting our net in the right waters, guided by our Intelligence Requirements, and hauling in the raw data. It might be messy, unverified, or fragmented - and that is perfectly fine. Making sense of it all is a job for the next phase.

Three collection environments, one evidence planInternal telemetry, public OSINT, and access-controlled sources contribute different evidence with provenance and handling requirements.INTRODUCTION TO CYBER THREAT INTELLIGENCEThree collection environments, one evidence planEach environment contributes a different kind of evidence.INTERNALlogs • alerts • incidentsOPEN SOURCEnews • blogs • public postsCLOSED SOURCESsubscriptions • trusted groupsCOLLECTION PLANsource • time • provenance • handlingEvidence remains traceablefrom collection to assessmentPlanning, Direction, and Collection
Three collection environments, one evidence plan — Internal telemetry, public OSINT, and access-controlled sources contribute different evidence with provenance and handling requirements.
← Previous: Why CTI Matters: Proactive Defense Next: Processing, Analysis, and Dissemination →