Skip to content
Pwnversity

Intelligence reporting

A CTI report is only worth anything if the right consumer understands it and acts. This card covers how to write actionable intelligence: structure, confidence/probability language, audience, and standards, so management decides and the SOC blocks.

Know the audience

Section titled “Know the audience”
Strategic (management/CISO)   risk, trends, business impact; little jargon
Operational (SOC/IR)          campaigns, TTPs, detection/response recommendations
Tactical (analysts/engineering) IOCs, rules, details to implement controls
# the SAME finding is told differently depending on who reads it and what they'll decide

Typical structure (BLUF)

Section titled “Typical structure (BLUF)”
BLUF (Bottom Line Up Front)   the conclusion and recommendation FIRST
Executive summary             what happened, who it affects, what to do (for management)
Technical analysis            TTPs (ATT&CK), chain (Kill Chain), Diamond, evidence
IOCs                          in a table + machine-readable format (STIX/CSV) to automate
Recommendations               actionable, prioritized, assignable
Assessment and confidence     what's known, what's assumed, confidence level

Estimative and confidence language

Section titled “Estimative and confidence language”
Probability words   use consistent scales (e.g. "almost certain" >90%,
                    "likely" 55-80%, "unlikely" 20-45%) -> unambiguous
Confidence levels   high/medium/low by source quality and corroboration
Separate FACT from ASSESSMENT  "X was observed" (fact) vs "we assess that Y" (analysis)
Attribution         cautious and with explicit confidence; avoid unfounded certainty

Standards and format

Section titled “Standards and format”
STIX/TAXII   machine-readable IOCs and CTI objects to share/automate
MISP         structured dissemination and exchange
TLP          mark the allowed distribution (RED/AMBER/GREEN/CLEAR)
ATT&CK       describe TTPs with T#### -> common language (cti-attack)

Common mistakes

Section titled “Common mistakes”
- burying the conclusion at the end (breaking BLUF) -> management doesn't read it
- mixing fact and speculation without marking it -> poorly founded decisions
- IOCs without context or expiry -> false positives when blocking (cti-ioc)
- vague recommendations ("improve security") -> not actionable

Blue Team / operation

Section titled “Blue Team / operation”
  • Write with BLUF and adapt the register to the audience; separate fact from assessment.
  • IOCs in machine-readable format (STIX) alongside the readable table -> automate blocking.
  • Mark TLP and confidence; recommendations actionable, prioritized, and assignable.
  • Close the loop with feedback (CTI fundamentals): did the report help decide/act?

Real-world cases

Section titled “Real-world cases”
  • Public reports from Mandiant/CrowdStrike/Microsoft are the model for structure and confidence language.
  • Using STIX/TAXII lets a report feed controls and the SIEM directly (SIEM).
  • Communication failures (buried conclusion, rushed attribution) have undercut good technical intelligence.

Testing checklist

Section titled “Testing checklist”
  • Identify the audience and the decision the report should enable
  • BLUF: conclusion and recommendation up front
  • Technical analysis with ATT&CK / Kill Chain / Diamond
  • IOCs in a table + machine-readable (STIX) with expiry/context
  • Consistent probability and confidence language
  • Separate fact from assessment; cautious attribution
  • Correct TLP and actionable/prioritized recommendations
  • Consumer feedback (intelligence cycle)

References

Section titled “References”