What are the stages of threat intelligence lifecycle and how should it be integrated into security operations?

• A. Planning, collection, processing, analysis, dissemination, and feedback.
• B. Initiation, execution, review, and closure.
• C. Detection, response, recovery, and renewal.
• D. Acquisition, normalization, distribution, and archiving.

Answer: (A)

The stages of threat intelligence lifecycle are planning, collection, processing, analysis, dissemination, and feedback. Start with planning to define what intelligence is needed based on business risk, assets, and threat landscape, setting clear requirements and timelines that align with security operations. Then collect data from multiple sources—internal telemetry like logs and alerts, external feeds, OSINT, commercial feeds, and even relevant dark‑web intel—ensuring the data is timely and relevant. Processing comes next, where you normalize, deduplicate, and enrich that data, turning raw indicators into a structured, usable dataset with context such as asset associations and geography. Analysis is the step where trained analysts interpret the data, assess credibility and relevance, map tactics, techniques, and procedures to frameworks like MITRE ATT&CK, and produce actionable intelligence that describes who the threat is, what they’re doing, and why it matters. Dissemination then delivers this intelligence to the right people in the right format—briefing emails, dashboards, intel reports, or integrated alerts in SIEM/SOAR systems—so SOC teams and incident responders can act quickly. Finally, feedback closes the loop: measure usefulness, capture outcomes, refine requirements, and adjust data sources and methods, so future intelligence is more accurate and timely.

Integrating this into security operations means feeding intelligence into daily work. Threat feeds enrich alerts, hunting plans, and detections; playbooks and automation can incorporate IOCs, YARA rules, or ATT&CK mappings to accelerate response; analysts can use intelligence to prioritize incidents and tailor mitigations; and the cycle should continually inform risk assessments, patch programs, and user education.

Other lifecycle models described by the distractors resemble general project management or incident response stages and don’t capture the full, repeatable flow from defining needs through to actionable, operational intelligence and feedback, which is why they’re less appropriate for threat intelligence integration.