Production

In the production phase of the intelligence life cycle, Ozark International Bank and its executives are likely looking for some way to consume the intelligence that has been generated. This type of intelligence could be in the form of a report, or it could be technical, such as STIX bundles. In this case, the CTI team at Ozark International Bank should be presenting the finished threat intelligence to the decision-makers of the organization, so a report must be created.

Threat intelligence reports are documents that describe actors, types of targeted systems, the Tactics, Techniques, and Procedures (TTPs) that are being used, vulnerabilities, and more. They're intended to give more situational awareness to an organization to help them facilitate active protection. These reports can and should be used in conjunction with a meeting to discuss the results of the report. Both deliverables should be easy to understand and consumable; otherwise, they will be mostly useless...