The process of generating and distributing high-quality, actionable threat intelligence is known as the threat intelligence cycle and can be described in six phases:
Planning and Direction – identifying and prioritizing assets and business processes that must be protected, and recognizing where new threat intelligence can fill gaps in organizational knowledge.
Data Collection – gathering relevant threat data from a variety of sources across the public and private attack surface, including network event logs, external threat intelligence feeds, the deep and dark web, and more.
Data Processing – cleaning, transforming, and processing data collected. AI-based platforms like ZeroFox help analysts normalize, structure, and deduplicate threat data, so it can be analyzed to produce useful insights.
Data Analysis – a combination of human and AI machine-learning analysis used to transform threat data into actionable intelligence. At ZeroFox, we analyze threat data using automated ML and AI-driven processes to deliver accurate, relevant threat intelligence to our customers.
Data Production – validating, sorting, and arranging data into contextually relevant visualizations and dashboards that make it easier for cybersecurity experts to identify what’s important, draw meaningful conclusions, and implement the right procedures for mitigating threats.
Distribution and Feedback – compiling and delivering finished threat intelligence reports to the appropriate stakeholders, which often include CSOs, SecOps, and incident response teams. CTI analysts collect feedback on these reports to continuously improve their threat intelligence activities.