Intelligence Requirements Overview

Overview

An Intelligence Requirement (IR) is a collection of topics or a research question reflecting an organization’s cyber threat–related priorities that guides a security or threat intelligence team’s research and analysis efforts. By establishing IRs, analysts can focus on investigating the things that matter most to their organization and stakeholders and spend less time sifting through various data sources for useful information.

In ThreatConnect^®, you can use the Intelligence Requirement feature to create an IR object with a logic-based keyword query that identifies and retrieves information relevant to the IR. In addition to creating standard IRs, you can create Priority Intelligence Requirements (PIRs), Specific Intelligence Requirements (SIRs), Requests for Information (RFIs), and Research Requirements (RRs). After you have created an IR object, ThreatConnect will query your owners and the ThreatConnect Global Intelligence Dataset for Cases, Groups, Indicators, Tags, and Victims that match the keywords included in the IR’s keyword query on a routine basis. The results of an IR’s keyword query are displayed on the IR’s Details screen, providing a central location where you can review the results and take an appropriate course of action for each one: associate the result to the IR object, archive the result, or mark the result as a false result.

Before You Start

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20159-01 v.01.A