GIRs

An intelligence requirement is an identified intelligence gap within the organization. We identify this as a piece of information that we don't have or a question that we can't answer – literally, a gap in our intelligence – and then we generate an intelligence requirement for it. GIRs are a collection of these gaps that require some form of CTI collection.

Intelligence requirements are simply collection goals that describe knowledge gaps generated from the data we want to collect. To establish a proactive response or even to fulfill an organizational need, it is fundamental that all collection be directed to build upon some corpus of cyber threat information. This is often referred to as the intelligence repository of an organization. It's important for the collection of these requirements to be fulfilled by a CTI group through security automation, threat hunting, or security research. Doing this will allow your CTI organization to stand up a capability...