# Threat Intelligence Analysis Frameworks

## Structured Analytic Techniques (SATs)

### Analysis of Competing Hypotheses (ACH)
1. Identify all reasonable hypotheses
2. List significant evidence/arguments for and against each
3. Create a matrix — evidence vs hypotheses
4. Assess diagnosticity of each piece of evidence
5. Refine matrix — remove non-diagnostic evidence
6. Draw tentative conclusions
7. Report most likely hypothesis with confidence level

### Diamond Model of Intrusion Analysis
Four core features per event:
- **Adversary**: threat actor or group
- **Capability**: tools, techniques, procedures
- **Infrastructure**: C2 servers, domains, IPs
- **Victim**: target organization, individual, system

Meta-features: timestamp, phase, result, direction, methodology, resources

### Kill Chain Mapping
Map intelligence to Lockheed Martin Cyber Kill Chain phases:
1. Reconnaissance → indicators: scanning patterns, OSINT activity
2. Weaponization → indicators: malware samples, exploit kits
3. Delivery → indicators: phishing emails, watering holes, USB
4. Exploitation → indicators: CVE usage, zero-days
5. Installation → indicators: persistence mechanisms, backdoors
6. Command & Control → indicators: C2 protocols, beaconing
7. Actions on Objectives → indicators: data exfiltration, destruction

### MITRE ATT&CK Framework Analysis
- Map observed TTPs to ATT&CK technique IDs
- Identify coverage gaps in detection
- Cross-reference with known threat actor profiles
- Track technique prevalence over time

## Intelligence Confidence Assessment

### Admiralty/NATO System
Source reliability (A-F):
- A: Completely reliable
- B: Usually reliable
- C: Fairly reliable
- D: Not usually reliable
- E: Unreliable
- F: Cannot be judged

Information credibility (1-6):
- 1: Confirmed by other sources
- 2: Probably true
- 3: Possibly true
- 4: Doubtful
- 5: Improbable
- 6: Cannot be judged

### Words of Estimative Probability (WEP)
| Term | Probability Range |
|------|------------------|
| Almost certain | 93-99% |
| Very likely / Highly probable | 80-92% |
| Likely / Probable | 63-79% |
| Roughly even chance | 40-62% |
| Unlikely / Improbable | 21-39% |
| Very unlikely / Highly improbable | 8-20% |
| Almost certainly not | 1-7% |

## Intelligence Production Workflow

### Collection Plan Template
```
Priority Intelligence Requirements (PIRs):
1. [Specific question about threat landscape]
2. [Specific question about adversary capabilities]
3. [Specific question about vulnerability exposure]

Collection Sources:
- Open Source: [feeds, blogs, social media]
- Technical: [malware samples, network telemetry]
- Human: [industry contacts, ISACs]
- Signals: [IDS/IPS alerts, SIEM correlations]

Collection Schedule: [frequency per source]
Dissemination: [who gets what, when, how]
```

### Intelligence Report Structure
1. **Executive Summary**: key findings, confidence levels, recommended actions
2. **Background**: context, previous reporting, scope
3. **Analysis**: detailed findings with evidence citations
4. **Assessment**: implications, future outlook, alternative hypotheses
5. **Recommendations**: specific, actionable, prioritized
6. **Appendices**: IOCs, raw data, methodology notes
