CTI Theory
The traditional Intelligence cycle describes how intelligence is ideally processed in civilian and military intelligence agencies, and law enforcement organizations.
This primer highlights structured analytic techniques — some widely used in the private sector and academia, some unique to the intelligence profession
The psychology of intelligence analysis by the CIA’s Center for the Study of Intelligence
The traditional intelligence life cycle tailored to threat intelligence embedded in modern security operations
Analysing relationships between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them
Center for Cyber Intelligence Analysis and Threat Research
The Diamond Model: a novel model of intrusion analysis built by analysts, derived from years of experience
The Cyber Kill Chain® framework is part of the Intelligence Driven Defense® model for the identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective
SANS shared a Cyber Kill Chain tailored to Industrial Control Systems (ICS), written by Michael J. Assante and Robert M. Lee.
The Analyst’s Style Manual is a product intended to assist student analysts with the many perplexing and complex rules they should follow in producing written intelligence products
The Intelligence Architecture Map is based on interviews of industry experts, former intelligence practitioners, and Freddy's personal views. It represents a logical and meaningful way of how different aspects of producing intelligence should be put together.
IS SHARING CARING? A comprehensive study on the current cyber threat intelligence inter-personal and social networking practices, results, and attitudes
A paper from the Carnegie Mellon ISR on the life-cycle of an advanced persistent threat group attack, from reconnaissance to data exfiltration
The OODA loop is the cycle observe–orient–decide–act. The approach explains how agility can overcome raw power in dealing with human opponents. It is especially applicable to cyber security and cyberwarfare.
Basics of Intelligence Management, including classification, evaluation, dissemination, and the intelligence confidence matrix
An argument that CTI is a product without a process, which has several underlying causes and consequences for the CTI practice. It is also argues that the field needs to implement traditional intelligence analysis and methodology, rather than add more technology
This is a collection of useful resources concerning intelligence writing such as manuals/guides, standards, books, and articles
Technical standards related to threat intelligence
Last updated