Lion Cipher Lab
Start a CTI program the right way: define intelligence requirements (PIRs) and a collection plan
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most new threat-intelligence programs fail the same way: someone buys a feed, indicators pour in, and a year later leadership asks what all of it changed — and the honest answer is nothing. Intelligence is not data; it is the answer to a question someone needs in order to make a decision. The single skill that separates a real CTI analyst from a feed-forwarder is the ability to turn 'what should we worry about?' into specific, answerable requirements, then figure out where the answers actually come from. That skill is requirements definition and collection planning, and it is what this lab…
What you'll learn
- cyber threat intelligence (CTI) fundamentals
- the intelligence cycle
- writing Priority Intelligence Requirements (PIRs)
- stakeholder analysis for intelligence
- building a collection plan matrix
- identifying collection gaps
Steps in this lab
- What CTI actually is — and what it is not
- The intelligence cycle — and why it starts with Direction
- Know your stakeholders — strategic, operational, tactical
- PIRs, IRs, and EEIs — the words that structure a program
- How to write a GOOD requirement — a decision, specific, answerable, time-bounded
- Map requirements to collection sources — and find the gaps
- When a small team should say 'we can't collect on that'
- Build the deliverable — stakeholders, PIRs, and a collection-plan matrix
- Do it better: review PIRs against what leadership actually decided