Intelligence Requirements Overview
  • 04 Oct 2023
  • 1 Minute to read
  • Dark

Intelligence Requirements Overview

  • Dark

Article Summary


An Intelligence Requirement (IR) is a collection of topics or a research question reflecting an organization’s cyber threat–related priorities that guides a security or threat intelligence team’s research and analysis efforts. By establishing IRs, analysts can focus on investigating the things that matter most to their organization and stakeholders and spend less time sifting through various data sources for useful information.

In ThreatConnect®, you can use the Intelligence Requirement feature to create an IR object with a logic-based keyword query that identifies and retrieves information relevant to the IR. In addition to creating standard IRs, you can create Priority Intelligence Requirements (PIRs), Specific Intelligence Requirements (SIRs), Requests for Information (RFIs), and Research Requirements (RRs). After you have created an IR object, ThreatConnect will query your owners and the ThreatConnect Global Intelligence Dataset for Cases, Groups, Indicators, Tags, and Victims that match the keywords included in the IR’s keyword query on a routine basis. The results of an IR’s keyword query are displayed on the IR’s Details screen, providing a central location where you can review the results and take an appropriate course of action for each one: associate the result to the IR object, archive the result, or mark the result as a false result.

The ThreatConnect Global Intelligence Dataset, historically known as CAL™, can still be leveraged even if an instance does not have CAL enabled. In this scenario, data returned from the ThreatConnect Global Intelligence Dataset will be read only, and no information stored in your instance will be shared with or collected by CAL.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing IRs and their results)
  • Organization role of Standard User (for creating, editing, and deleting IRs; retrieving results manually for IRs; and managing keyword queries, results, and associations for IRs)
  • System role of Administrator (for viewing, creating, editing, and deleting IR categories)

ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20159-01 v.01.A

Was this article helpful?