managing-intelligence-lifecycle

name	managing-intelligence-lifecycle
description	Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers.
domain	cybersecurity
tags	["CTI","intelligence-lifecycle","PIR","NIST-SP-800-150","threat-intelligence-program","NIST-CSF"]
subdomain	threat-intelligence
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Managing Intelligence Lifecycle

Overview

Cybersecurity skill for managing intelligence lifecycle. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "managing intelligence lifecycle"
• "Establishing a formal CTI program and defining its operational model"
• "Conducting quarterly intelligence requirements reviews with business stakeholder"
• "Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG ma"

Use this skill when:

• Establishing a formal CTI program and defining its operational model
• Conducting quarterly intelligence requirements reviews with business stakeholders
• Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)

Do not use this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Executive sponsorship and defined CTI team structure (1+ dedicated analysts)
• Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)
• Existing feed subscriptions or ISAC memberships for collection baseline
• CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}