# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 2 Background of Cyber Intelligence
### Levels and Typologies  
The diverse typologies of recipients and target audiences present in the management of cyber intelligence make it necessary to establish a stratification or distinction; thus, three levels can be observed [16]:  
* The strategic level is focused on supporting decision making on the policies and objectives of an organisation. In this sense, the knowledge, study, and possible evolution of the malicious actors involved that can influence the organisation's risks are essential. An example is the analysis of the organisation's exposure to the main groups that exploit ransomware-type malware or carry out Advanced Persistent Threat (APT) actions. * The tactical level is aimed at supporting the planning of specific actions that enable the achievement of the organisation's strategic objectives, for example, the analysis of the attack Tactics, Techniques, and Procedures (TTPs) of a given malicious actor. * The operational level refers to the knowledge that allows decisions to be taken in a short space of time in the framework of the actions necessary to prevent a given attack or incident, e.g., the analysis of indicators of compromise (IOCs) that represent a threat to the organisation. Handling the data traditionally associated with operational intelligence, i.e., indicators of compromise (hashes, domains, IPs, etc.) reflected in the lower rungs of [PERSON]'s (2013) [17] panic pyramid (see Figure 1), is extremely complex due to the sheer variety, ease of substitution, and poor correlation between them. On the other hand, the data associated with strategic intelligence are sometimes diffuse, not easily processed, and very difficult to obtain in a structured way. Therefore, this research focuses on the development of tactical intelligence products through the extensive study of TTPs. On the other hand, three branches or typologies of cybersecurity have been identified as those where cyber intelligence has the greatest utility and application: cyber threat intelligence, incident response, and vulnerability management. Threat intelligence or cyber threat intelligence (CTI) is focused on making decisions about the policies and objectives of an organisation in terms of information security or operation. To this end, it tries to collect and analyse all types of data to address the organisation's risks for the protection of its technological assets with three clear objectives: that the intelligence is relevant, that it is accurate, and that it is adjusted over time to needs. In this sense, it seems appropriate to adopt a cyclical model similar to that of classic military intelligence, widely discussed and studied in recent decades, whereby products  
Figure 1: Panic pyramid [17]. are produced through a recurring process and updated according to the reality present in each time period [9]. For the proper implementation of this cycle, smooth cooperation between the different actors involved is essential. * Phase 1. Planning and management. In this phase, the RPIs are identified based on the prior definition of critical assets and relevant threats whose exploitation generates an impact. * Phase 2. Collection. Data collection is carried out following structured methods based on the requirements of the previous phase. * Phase 3. Processing. The collected data are processed with appropriate techniques. * Phase 4. Analysis and production. This is a critical phase of the cycle in which the information obtained in previous phases is transformed into intelligence. Today, it requires the presence of the human factor. * Phase 5. Dissemination. This is the stage in which the intelligence is provided to decision-makers so that they have the appropriate knowledge. * Phase 6. Utilisation. Decision making based on the delivered product is considered another critical and decisive moment in the cycle. The incident response (IR) branch is focused on the integral response to incidents detected in the organisation. The application of intelligence to this branch is based on the proposal in [18]. * Phase 1. Preparedness.