CTI OPERATIONS

CHECKLIST

Standard Operating Procedures for Intelligence Teams

VERSION 1.0JANUARY 2026STRATIR.COM

STRATIRDOC.2026.CTI.001

Phase 1: Requirements Definition

Before collecting anything, define what you need to know and why.

□Intelligence Question: What specific question does this collection answer? Write it as a single sentence.

□Stakeholder: Who will use this intelligence? What decision will it inform?

□Timeline: When is the intelligence needed? Is this ongoing or incident-driven?

□Classification: What sensitivity level applies to the output?

Phase 2: Collection

Gather raw data from identified sources. Prioritize reliability over volume.

□Source Selection: Identify 3-5 sources likely to have relevant data. Avoid source overload.

□Query Design: Define exact search parameters. Document the query for reproducibility.

□Collection Execution: Run queries. Log timestamps, source URLs, and raw outputs.

□Evidence Preservation: Archive screenshots and original files before any processing.

STRATIRDOC.2026.CTI.001

Phase 3: Processing

Transform raw data into structured, analyzable formats.

□Normalization: Standardize date formats, naming conventions, and data types.

□Deduplication: Remove duplicate records. Note which sources provided the same data.

□Enrichment: Add context from secondary sources (geolocation, threat actor attribution, MITRE mapping).

□Validation: Cross-reference key facts across multiple sources. Flag single-source claims.

Phase 4: Analysis

Transform processed data into actionable intelligence.

□Threat Actor Attribution: If applicable, map to known threat groups. Assign confidence level.

□MITRE ATT&CK Mapping: Identify relevant tactics, techniques, and procedures. Document T-codes.

□Impact Assessment: What is the potential impact to your organization? Rate severity.

□Confidence Scoring: How reliable is this analysis? (A: Confirmed, B: Probable, C: Possible, D: Doubtful)

□Recommendations: What should stakeholders do with this intelligence? Be specific and actionable.

STRATIRDOC.2026.CTI.001

Phase 5: Dissemination

Deliver intelligence to stakeholders in formats they can use.

□Format Selection: Match output format to audience (executive brief, technical report, indicator feed).

□Review: Second analyst reviews before distribution. Flag any disagreements.

□Distribution: Send via appropriate secure channel. Confirm receipt from key stakeholders.

□Indicator Export: If applicable, push IOCs to detection platforms in STIX/TAXII format.

Phase 6: Feedback

Close the loop. Learn from every cycle.

□Stakeholder Feedback: Did the intelligence answer their question? Was it timely? Actionable?

□Outcome Tracking: If detections were deployed, did they fire? Were they true positives?

□Lessons Learned: What would you do differently? Document for future reference.

NEED HELP IMPLEMENTING?

This checklist provides the framework. If you need help building automated CTI workflows, integrating with your detection platforms, or training your team, reach out directly.

VANCE@STRATIR.COM